No replies to this topic

[thetit4n]

Hello folks! I'm Dan and you are going to experience my FIRST GSO TUTORIAL! (I get a little excited sometimes....)

Anyways, Here goes:


There are some major differences between PHP4 and PHP5's OOP, I'm going to give a looksie into PHP5's OOP and try and name some major differences and giving an intro to PHP OOP at the same time . This tutorial doesn't relate directly to security but web security is a real issue and PHP is a major part of the web, so when your scouring through source code looking for an exploit, it helps to know what your looking at! So i thought it related a little bit and ill try and point out as many areas that should be secured and how to use this to secure your site.



The Basics:

PHP classes(or objects) are very useful when developing a project that is very large or repetitive. For instance, if you were developing a website using user authentication from a MySQL database. You could use multidimensional arrays and store user related functions in another file (user_functions.php), or youcould neatly store all of that away together in one single object. It works as an option to store many useful things and in PHP5 even hide them from the script running it! This can add a major difference to how you program and how a program runs.


A class in PHP is basically just a layout of a container(object) for a few(or many) different variables and functions(called methods) as i explained earlier (weren't you listening?! ). When you create a class you have just created a template for an object. An object is the actual container that you will use to store data. An object looks just like a variable in the sense that it has an "$" in front, but it is much more and i will explain.... NOW:

The syntax to create a class(the template) is this:

class Item{
	//class information goes here
}

pretty simple huh! well it is!

To make an object out of your class you do this:

$object = new Item();

Even simpler HUH! Well, yes it is!

Lets look at a real example using a simple method:

<?php
class Item{

var $name = "Default Name"; //the "var is necessary and the Default value can be ONLY a string, not even a variable

function print_name(){
echo $this->name;  //"$this" is a pseudoclass which pertains to the class its en-capsuled in
}

}

$obj = new Item();
$obj->print_name();
?>

This script will give the output:

Default Name

Now if we start going any farther into this i have to start explaining the differences between PHP4 and PHP5. That brings us to the next step,

Understanding the differences between PHP4 and PHP5

The major difference between them is that PHP5 is that you have the option to make variables "private" or "protected", those two terms mean very similar things, but during this tutorial we are going to focus on private. (Remember this is only in PHP5). Another major difference is the way you user constructors, we will talk about these later. Lets recreate the script that we made earlier for PHP5 and demonstrate some differences.

<?php
//this one is for PHP5

class Item{

   public $pubVar = "Public Variable";
   private $privVar = "Private Variable";

   function get_priv_var(){
		return $this->privVar;
   }

}


$obj = new Item();
echo $obj->pubVar;
echo $obj->get_priv_var();

/*
the function:
echo $obj->privVar;

would return a fatal error

*/

?>

This script is not possible a regular installation of PHP4, you can only use var to define variables, so on PHP4 you cannot hide variables from the script. From the security point of view this could be a vulnerability if you could inject some code that would spit out a variable containing crucial information in a class. (I have not researched this at all, thats up to you)


Constructors

A constructor is a specific method in a class that automatically fills in variables in a class. Constructors for PHP4 and PHP5 are also very different. I feel that I can give a better understanding by example, and here they are:

A Regular PHP4 Constructor

<?php

class Item{

var $name;

function Item( $n = "Default Name" ){  //this is the constructor, it is defined because the function name is the same as the class name.
   $this->name = $n;
}

function output_name(){
	 return $this->name;
}

}



$obj1 = new item("Roger");
$obj2 = new item();

echo $obj1->output_name();
echo "<br />";
echo $obj2->output_name();

?>

Hopefully that gives you a somewhat comprehensive look at what constructors do and what they can be used for. (In PHP4 anyways)

Now for PHP5, A little different:

<?php

class Item{

var $name;  //notice i use var here, it still works in PHP5, same as "public"


function __construct(  $n = "Default Name" ){   //as you can probably see, this is the new construct.  is is(underscore)(underscore)constructor(), but it works in the same way
$this->name = $n;
}


/*
I could have also done this, it still works in PHP5

function Item( $n = "Default Name" ){  //this is the constructor, it is defined because the function name is the same as the class name.
   $this->name = $n;
}
*/

function output_name(){
	 return $this->name;
}

}



$obj1 = new item("Roger");
$obj2 = new item();

echo $obj1->output_name();
echo "<br />";
echo $obj2->output_name();

?>

As you can see it is very similar but slightly different.

Conclusion, What we learned

We learned quite a few things here during this somewhat short tutorial. I introduced OOP Object Oriented Programming and the syntax for the use in PHP, I pointed out some major differences in PHP4 and PHP5's OOP. We learned about Public and Private variables within a class or object. And we also learned how to use constructors in PHP4 and PHP5. Now im going to give you a small list of ides for your brainstorming on what you can do with your newfound knowledge.

You could:

• Revamp the user system to use private variables for the user information on your clan website
• You could make a script to encrypt messages in your own cipher using a class for the key and a class for the message so only your friends could read it (keep in mind this is for fun!)
• Make a Script to store friends addresses and phone numbers in a database using objects for each person
• Use your imagination, They are SOO useful

I am going to wrap up this tutorial here and hope you all enjoy it and hopefully learn from it!

knowledge is Power!
Never stop learning, its the worst thing you can do! If you have a question ask it, If you have a solution make it known so others can learn with you! Programmers are a special breed of people. It takes much more than what meets the eye, all you can do is keep learning!
I really like these forums and i plan to stick around. I hope this makes up for the thank you post i left and later found out was VERY looked down upon !


Dan