(I get a little excited sometimes....)Anyways, Here goes:
There are some major differences between PHP4 and PHP5's OOP, I'm going to give a looksie into PHP5's OOP and try and name some major differences and giving an intro to PHP OOP at the same time
. This tutorial doesn't relate directly to security but web security is a real issue and PHP is a major part of the web, so when your scouring through source code looking for an exploit, it helps to know what your looking at! So i thought it related a little bit and ill try and point out as many areas that should be secured and how to use this to secure your site.The Basics:
PHP classes(or objects) are very useful when developing a project that is very large or repetitive. For instance, if you were developing a website using user authentication from a MySQL database. You could use multidimensional arrays and store user related functions in another file (user_functions.php), or you could neatly store all of that away together in one single object. It works as an option to store many useful things and in PHP5 even hide them from the script running it! This can add a major difference to how you program and how a program runs.
A class in PHP is basically just a layout of a container(object) for a few(or many) different variables and functions(called methods) as i explained earlier (weren't you listening?!
). When you create a class you have just created a template for an object. An object is the actual container that you will use to store data. An object looks just like a variable in the sense that it has an "$" in front, but it is much more and i will explain.... NOW:The syntax to create a class(the template) is this:
CODE
class Item{
//class information goes here
}
//class information goes here
}
pretty simple huh! well it is!
To make an object out of your class you do this:
CODE
$object = new Item();
Even simpler HUH! Well, yes it is!
Lets look at a real example using a simple method:
CODE
<?php
class Item{
var $name = "Default Name" //the "var is necessary and the Default value can be ONLY a string, not even a variable
function print_name(){
echo $this->name //"$this" is a pseudoclass which pertains to the class its en-capsuled in
}
}
$obj = new Item();
$obj->print_name();
class Item{
var $name = "Default Name" //the "var is necessary and the Default value can be ONLY a string, not even a variable
function print_name(){
echo $this->name //"$this" is a pseudoclass which pertains to the class its en-capsuled in
}
}
$obj = new Item();
$obj->print_name();
This script will give the output:
Default Name
Now if we start going any farther into this i have to start explaining the differences between PHP4 and PHP5. That brings us to the next step,
Understanding the differences between PHP4 and PHP5
The major difference between them is that PHP5 is that you have the option to make variables "private" or "protected", those two terms mean very similar things, but during this tutorial we are going to focus on private. (Remember this is only in PHP5). Another major difference is the way you user constructors, we will talk about these later. Lets recreate the script that we made earlier for PHP5 and demonstrate some differences.
CODE
<php
//this one is for PHP5
class Item{
public $pubVar = "Public Variable;
private $privVar = "Private Variable";
function get_priv_var(){
return $this->privVar;
}
}
$obj = new Item();
echo $obj->pubVar;
echo $obj->get_priv_var():
/*
the function:
echo $obj->privVar;
would return a fatal error
*/
?>
//this one is for PHP5
class Item{
public $pubVar = "Public Variable;
private $privVar = "Private Variable";
function get_priv_var(){
return $this->privVar;
}
}
$obj = new Item();
echo $obj->pubVar;
echo $obj->get_priv_var():
/*
the function:
echo $obj->privVar;
would return a fatal error
*/
?>
This script is not possible a regular installation of PHP4, you can only use var to define variables, so on PHP4 you cannot hide variables from the script. From the security point of view this could be a vulnerability if you could inject some code that would spit out a variable containing crucial information in a class. (I have not researched this at all, thats up to you)
Constructors
A constructor is a specific method in a class that automatically fills in variables in a class. Constructors for PHP4 and PHP5 are also very different. I feel that I can give a better understanding by example, and here they are:
A Regular PHP4 Constructor
[code]
<?php
class Item{
var $name;
function Item( $name = "Default Name" ){ //this is the constructor, it is defined because the function name is the same as the class name.
}
}