Web Development Concepts in PHP
Web Development Concepts in PHP
1. HTTP Protocol
The HyperText Transfer Protocol (HTTP) is the foundation of communication between clients (browsers) and servers. It follows a request-response model.
1.1 HTTP Methods
Method Description
GET Retrieves data from the server (e.g., URLs, forms without sensitive data).
POST Sends data to the server (e.g., form submissions, login).
PUT Updates existing data on the server.
DELETE Removes data from the server.
PATCH Partially updates data.
HEAD Retrieves response headers only.
✅ Example: Handling GET and POST requests in PHP
<?php
if ($_SERVER["REQUEST_METHOD"] == "GET") {
echo "GET request received.";
} elseif ($_SERVER["REQUEST_METHOD"] == "POST") {
echo "POST request received.";
}
?>
1.2 HTTP Status Codes
Code Meaning
200 OK (Success)
301 Moved Permanently (Redirect)
400 Bad Request
401 Unauthorized
403 Forbidden
404 Not Found
500 Internal Server Error
✅ Example: Sending a 404 Error
<?php
http_response_code(404);
echo "Page not found.";
?>
2. Web Security Best Practices
2.1 Preventing SQL Injection
SQL Injection occurs when attackers insert malicious SQL queries through input fields.
✅ Solution: Use Prepared Statements
<?php
$conn = new mysqli("localhost", "user", "password", "database");
$stmt = $conn->prepare("SELECT * FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$email = "user@example.com";
$stmt->execute();
$result = $stmt->get_result();
?>
2.2 Preventing Cross-Site Scripting (XSS)
XSS allows attackers to inject malicious scripts into web pages.
✅ Solution: Escape Output
<?php
$user_input = "";
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8'); // Secure output
?>
2.3 Preventing Cross-Site Request Forgery (CSRF)
CSRF attacks trick users into submitting unauthorized requests.
✅ Solution: Use CSRF Tokens
<?php
session_start();
$_SESSION['token'] = bin2hex(random_bytes(32));
?>
<form method="POST">
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
<button type="submit">Submit</button>
</form>
✅ Verifying the Token
<?php
if ($_POST['token'] !== $_SESSION['token']) {
die("CSRF attack detected!");
}
?>
3. Front-End Integration (HTML, CSS, JavaScript with PHP)
PHP is used with HTML, CSS, and JavaScript to create dynamic web pages.
3.1 Embedding PHP in HTML
<!DOCTYPE html>
<html>
<head>
<title>PHP Integration</title>
</head>
<body>
<h1>Welcome, <php echo "User"; ?></h1>
</body>
</html>
3.2 Handling Form Data with PHP
<!DOCTYPE html>
<html>
<body>
<form method="POST">
Name: <input type="text" name="name">
<button type="submit">Submit</button>
</form>
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
echo "Hello, " . htmlspecialchars($_POST["name"]);
}
?>
</body>
</html>
3.3 Using JavaScript for Validation Before Submitting to PHP
<script>
function validateForm() {
let name = document.forms["myForm"]["name"].value;
if (name === "") {
alert("Name is required");
return false;
}
}
</script>
<form name="myForm" onsubmit="return validateForm()" method="POST">
Name: <input type="text" name="name">
<button type="submit">Submit</button>
</form>
3.4 Sending AJAX Requests to PHP
<script>
function loadData() {
fetch("data.php")
.then(response => response.text())
.then(data => document.getElementById("result").innerHTML = data);
}
</script>
<button onclick="loadData()">Load Data</button>
<div id="result"></div>
✅ Example: data.php (Returns Data)
<?php
echo "Data loaded successfully!";
?>
3.5 Styling PHP Output with CSS
<!DOCTYPE html>
<html>
<head>
<style>
.message { color: green; font-size: 20px; }
</style>
</head>
<body>
<p class="message"><?php echo "Styled Message from PHP!"; ?></p>
</body>
</html>
Conclusion
✅ HTTP → Manages communication between clients & servers.
✅ Web Security → Protects against SQL Injection, XSS, and CSRF attacks.
✅ Front-end Integration → PHP works with HTML, CSS, and JavaScript for dynamic web pages.Date: 2025-03-28 00:00:00.000000