Chapter 7. Storing Information with Databases
The HTML and CSS that give your web site its pretty face reside in
individual files on your web server. So does the PHP code that
processes forms and performs other dynamic wizardry.
There's a third kind of information necessary to a
web application, though: data. And while you can store data such as
user lists and product information in individual files, most people
find it easier to use databases, which are the focus of this chapter.
Lots of information falls under the broad umbrella of
"data":
Who your users are, such as their names and email addresses. What your users do, such as message board posts and profile
information. The "stuff" that your site is
about, such as a list of record albums, a product catalog, or
what's for dinner.
There are three big reasons why this kind of data belongs in a
database instead of in files: convenience, simultaneous access, and
security. A database program makes it much easier to search for and
manipulate individual pieces of information. With a database program,
you can do things such as change the email address for user
Duck29 to
ducky@ducks.example.com in one step. If you put
usernames and email addresses in a file, changing an email address
would be much more complicated: read the old file, search through
each line until you find the one for Duck29,
change the line, and write the file back out. If, at same time, one
request updates Duck29's email
address and another updates the record for user
Piggy56, one update could be lost, or (worse) the
data file corrupted. Database software manages the intricacies of
simultaneous access for you.
In addition to searchability, database programs usually provide you
with a different set of access control options compared to files. It
is an exacting process to set things up properly so that your PHP
programs can create, edit, and delete files on your web server
without opening the door to malicious attackers who could abuse that
setup to alter your PHP scripts and data files. A database program
makes it easier to arrange the appropriate levels of access to your
information. It can be configured so that your PHP programs can read
and change some information, but only read other information. However
the database access control is set up, it doesn't
affect how files on the web server are accessed. Just because your
PHP program can change values in the database
doesn't give an attacker an opportunity to change
your PHP programs and HTML files themselves.
The word database is used in a few different
ways when talking about web applications. A database can be a pile of
structured information, a program (such as MySQL or Oracle) that
manages that structured information, or the computer on which that
program runs. In this book, I use
"database" to mean the pile of
structured information. The software that manages the information is
a database program, and the computer that the
database program runs on is a database server.
Most of this chapter uses the PEAR DB database program abstraction layer.
This is an add-on to PHP that simplifies communication between your
PHP program and your database program. PEAR (PHP Extension and Application Repository) is a
collection of useful modules and libraries for PHP. The
DB module is one of the most popular PEAR modules
and is bundled with recent versions of PHP. If your PHP installation
doesn't have DB installed (Section 7.2, later in this chapter,
shows you how to check), see Section A.3
for instructions on how to install it.
When DB isn't available, you need to rely on other
PHP functions to talk to your database program. The appropriate set
of functions varies with each database program. Some of the more
exotic features of your database program may only be accessible
through the database-specific functions. Later in this chapter, Section 7.12 discusses
shows how to work with the functions in the mysqli extension, which
talks to MySQL (Versions 4.1.2 and greater).
|
