PHP is a dynamic, weakly-typed language, and as such, beginners to the language will often find their code acting unpredictably because of assumptions they have made.

PHP has a fairly low entry point for new programmers - it’s easy enough to get a couple of small sample scripts up and running, but on the same token, it’s really easy to pick up bad habits and carry them through into larger projects. Since PHP is often the first language used extensively by a new generation of web programmers, and doesn’t have strict typing or error reporting, a lot of people simply never pick up the best practices for system design and implementation.

This tutorial is going to be a quick introduction to variables in PHP, and how to test them effectively for missing or incorrect data.

To define a variable in PHP, you simply refer to it and assign it a value. Notice that you don’t need to place a type before it, e.g. int or string.

  $var1 = 'abc';

One variable is now present in your system, $var1, with the value abc.

If you are planning on using a group of variables in your program, it is generally good practice to declare them near the top of your function or method, or near the top of the file, and assign them sensible default values:

  $counter = 0;
  $name = '';
  $max = 10;

Testing variables

To maintain a predictable system, you need to ensure that you are always testing variables for expected values and sanitising them where necessary. Sanitising refers to cleaning up any data that has come from an untrusted source, i.e. a user submitted form or something similar. Such data must never be used directly without being checked or parsed - a common mistake is to take data a user has submitted and immediately use it in a database query:

  $query = "SELECT * FROM table WHERE name LIKE = {$_POST['name']}";

This is a classic example of an SQL injection flaw. A malicious user could easily craft a request to modify or even drop your entire database.

A better query would look like this:

  $name = mysql_escape_string($_POST['name']);
  $query = "SELECT * FROM table WHERE name LIKE = '$name'";

Notice the additional quotes around $name in the query; and the curly braces around the variable are no longer required as it isn’t a value being accessed in an array. Additionally, notice that the $query string is surrounded by double quotes (”) - this means that variables and string literals inside the string will be parsed.

  $name = 'Michael';
  $test1 = 'My name is $name';
  $test2 = "My name is $name";

Try printing the variables above in your own script and see the difference. $test1 will say ‘My name is $name‘ whilst $test2 will say ‘My name is Michael‘.

PHP provides several functions to test variables with, here is a table of the results from a couple of them:

$var is	Function	PHP returns
(not set)	isset	false
” (empty string)	isset	true
123	isset	true
null	isset	false
” (empty string)	empty	true
123	empty	false
(not set)	empty	true

Above, we use empty to test if a variable has a value, this function will return FALSE if variable has a non-empty and non-zero value. The following are values that PHP treats as false (zero):

• "" i.e. empty string
• 0 as an Integer
• "0" as a String
• NULL
• FALSE
• array()

Also note that empty only tests variables, anything else will result in a parse error. In other words, the following will not work: empty(trim($name)); (From www.php.net/empty).

Once a variable is defined (or set), you can use unset($var) or $var = null to destroy it.

Because PHP is weakly-typed, since PHP 5 (I think, maybe sooner), an additional operator has been included. By extending the standard boolean test operator ‘==’ to 3 equal signs, ‘===’, the variables being tested will also be tested to see if their base types match. In other words:

  (0 == '')

returns true because both are seen as false (0) by PHP, but

  (0 === '')

returns false because 0 is an integer and ” is a string, so their values match, but not their types.

This additional checking can also be used in the negative form, i.e. ‘!==’.

Using everything we’ve discussed above, a sensible way to read from the HTTP POST parameter super-global and set a default value is to use the ternary operator in PHP:

  $name = (isset($_POST['name'])) ? $_POST['name'] : 'none';

A good way to quickly play around with all these different functions, and to test your logic, is to use the PHP interactive shell (PHP 5.1 onwards):

$ php -a

Alternatively use PHP-Shell which has more features than the built-in shell (link below).

Related links

1. PHP-Shell by Jan Kneschke
2. http://www.php.net/manual/en/function.isset.php
3. http://www.php.net/manual/en/function.empty.php
4. http://www.php.net/manual/en/function.unset.php

Comments(1)

Welcome to the first of five articles in the Web Expose Back to Basics project. Each article is going to cover a seperate and distinct topic, with the aim of providing worthwhile beginner tutorials to aid in furthering your web development skills.

The topic for today is using the popular MySQL database to logically store and retrieve data stored in several tables, avoiding data duplication. This is commonly referred to as ‘joining tables’ - and the links between two or more tables are often called ‘foreign key links’. This article deals with MySQL because it is the most readily available and popular database for PHP developers at this point in time, but the examples should work with zero to minimum modifications on most other popular relational database systems.

Using a join to link two tables together refers to the fact that by identifying a common column in both tables, you can use this column to join the two tables together and return a combined result set.

In this example picture, the green columns illustrate two sets of data that are common between the two tables. For example, these could be two tables with user email addresses in them; you could then join the tables on that email column. In most cases though, you will hopefully have designed the database to avoid data duplication (called normalisation) and these common fields will usually be integer ID fields. We can now use a join statement to combine the two tables and return a result set that looks like this:

Here, all the columns from table 1 are laid out as normal, then the matching row’s columns from table 2 are appended to each row. This will only happen if you have the correct filter conditions in place though - without a proper WHERE statement, every row in table 1 will be duplicated as many times as there are rows in table 2, providing you with a potentially huge result set.

I realise the above might be confusing, so I think it’s time to do some proper examples with SQL. I’m using MySQL 4.1.6 and phpMyAdmin 2.8.04 to control it, but almost any version will do. phpMyAdmin isn’t required, but is a very good web-based interface to the MySQL RDBMS. If you’re accessing MySQL using the command line tool, remember that you never pass the password through on the command line arguments.

  mysql -u username -p -h localhost

MySQL will prompt you for the password; neglecting the -p argument will make MySQL attempt to connect with a blank password.

Using the command line tool, or phpMyAdmin’s query tool, create two test tables to play with:

Creating tables

  CREATE TABLE `b_products` (
  `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
  `name` VARCHAR( 100 ) NOT NULL ,
  `category_id` INT NOT NULL
  );

  CREATE TABLE `b_categories` (
  `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
  `name` VARCHAR( 100 ) NOT NULL
  );

Populate tables with some data

  INSERT INTO `b_categories`(`name`)
  VALUES ('DVD');

  INSERT INTO `b_products`(`name` , `category_id`)
  VALUES ('Flatline', '2');

(Whenever you see data being populated, you should create some of your own as I haven’t listed all the INSERTs here, to keep the text a bit shorter. If you scroll to the bottom of the post, you can download all the tables and data I used in SQL format.)

The 2 in the last line of the INSERT is the relevant category id you want to link the product to. As you can see, the product table has a category_id, which is called a foreign key, as it refers to a table foreign to the current table. This abstraction of data allows us to avoid having to repeat data (i.e. we don’t have to type ‘DVD’ next to each product, we can simply enter the ID of the ‘DVD’ category). If ‘DVD’ ever changes to ‘HD DVD’, all we have to do is update the category table entry, and everything else will update automatically.

Sample query - fetch all products and their matching categories

  SELECT *
  FROM `b_products` p, `b_categories` c
  WHERE p.category_id = c.id;

Placing an identifier after the table name in the FROM statement allows us to assign an alias to the table; we can then refer to fields inside that table specifically by using the alias.columnname syntax. This is an important step when using joins, often tables share columns with the same name, and you have to explicitly state which one you want to match or fetch.

Result

Here you can see that category_id and id are outlined in orange and next to each other - the first three columns are from the product table, and the last two columns from the category table - the join effect is apparent here.

On line 3 of the above query, you can see that we’re limiting each row to only return the correct row from the category table - i.e. we only want to fetch data where the product category ID is the same as the category ID in the external table.

Compare the above to the following query without a WHERE clause:

  SELECT *
  FROM `b_products` p, `b_categories` c;

If you run this query, you’ll see that each row of the products table is joined against every single row in the categories table, as described in the beginning of the post.

Fetch all CD products, and only select the 3 relevant columns

  SELECT p.id, p.name, c.name
  FROM `b_products` p, `b_categories` c
  WHERE p.category_id = c.id
  AND c.name LIKE 'CD';

Result

Advanced: count the number of products in each category

  SELECT COUNT(p.id) AS count, c.name
  FROM `b_products` p, `b_categories` c
  WHERE c.id = p.category_id
  GROUP BY c.name;

Result

Let’s move on to another example, one where the two tables can have multiple links between each other (sometimes called a has-and-belongs-to-many relationship).

Create two additional tables and some data links

  CREATE TABLE `b_owners_products` (
  `owner_id` INT NOT NULL ,
  `product_id` INT NOT NULL
  );

  CREATE TABLE `b_owners` (
  `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
  `name` VARCHAR( 100 ) NOT NULL
  );

  INSERT INTO `b_owners_products`(`owner_id` , `product_id`)
  VALUES ('4', '3');

We don’t have to modify the owners table, or the product table - all the link information is stored in a third external table called owners_products (the convention is to put the table names alphabetically, seperated by a ‘_’).

Linking the two tables, using the third as a reference

  SELECT *
  FROM `b_owners` o, `b_products` p, `b_owners_products` op
  WHERE o.id = op.owner_id
  AND p.id = op.product_id;

Result

Doing something useful with the link

  SELECT o.name, p.name
  FROM `b_owners` o, `b_products` p, `b_owners_products` op
  WHERE o.id = op.owner_id
  AND p.id = op.product_id
  AND o.name = 'Bob';

Result

This fetches all products belonging to ‘Bob’.

More information

1. Sample tables and data for this article
2. A detailed explanation of JOINs
3. Ensuring foreign key integrity
4. More information on JOINs

Comments(1)