Figure 1-9 The New Project dialog box—so many choices

Your New Project dialog box may differ slightly depending on the features you chose to install with Visual Studio. The available projects are grouped by the description in the Project types field. For instance, Figure 1-9 shows the various default project types you can create in Visual Basic, including Windows Applications (standard desktop applications for the Windows platform, Class Libraries (a DLL of class-defined features), and Console Applications (command-line text-based applications). To create a new application, first select the project type, select the Template to use, and finally enter the name of the new project in the Name field. Clicking the OK button creates a new project.

To use the sample Chapter 1 project, select the Start-to-Finish Visual Basic 2005 entry within the Visual Basic project type, and then select Chapter 1 Sample from the Template field (see Figure 1-10). Finally, click OK to create the new sample project.

Figure 1-10 Selecting the Chapter 1 Sample project

Once the project loads, access the program’s main form by double-clicking on the Form1.vb file in the Solution Explorer (see Figure 1-11).

Figure 1-11 The main form of the sample application

This default presentation of Visual Studio Professional Edition includes three editing components: (1) the main editing area, where the view of “Form1″ appears; (2) the Solution Explorer panel, which provides access to all files included in the project; and (3) the Properties panel, which lets you edit various aspects of the currently selected item in the main editor area or elsewhere in the user interface.

The sample project is pretty basic. It includes one form with a single action button. Clicking this button in the running application displays a simple message. Run the project by pressing the F5 key. When the main form appears, clicking on the Go Ahead, Click Me button to display the message in Figure 1-12 (goal, sweet goal).

Figure 1-12 Hello again, world!

So, how about all of that complex code I had to write to develop this multifaceted application? It’s all there for the viewing. From the Solution Explorer panel, right-click on the Form1.vb entry, and select View Code from the shortcut menu. (As with most source code samples presented in this book, I have had to slightly adjust the code so that it displays properly on the printed page. Generally, this involves splitting a long logical line into two or more shorter ones.)

Public Class Form1
  Private Sub Button1_Click(ByVal sender As System.Object, _
     ByVal e As System.EventArgs) Handles Button1.Click
   MsgBox("Hello, World!")
  End Sub
End Class

We’ll get into the intricacies of such code in later chapters, but here is the gist.

• The main form, Form1, is represented in code by a class, named Form1.

• The form includes a command button named Button1 that exposes a Click event. This event is handled by the Button1_Click procedure, a member of the Form1 class.

• The “event handler,” Button1_Click, includes a single statement, a “MsgBox” statement. This statement does the heavy lifting by presenting the ever-friendly message box to the world.

That’s all of the code that I wrote for “Form1.vb“. It sure seems pretty short for all the work it does. There has to be more code hiding somewhere. And sure enough, there are actually half-a-dozen or so more files included in the project. Visual Studio hides these by default, since it manages some or all of the content in these files on your behalf. To view the files, click on the “Show All Files” button (the second toolbar button from the left in the Solution Explorer panel). Look at all those files! To see the additional files associated with Form1, expand it by clicking on the plus sign to its left (see Figure 1-13).

Figure 1-13 Viewing hidden files through the Solution Explorer

Double-click on the Form1.Designer.vb entry to see the code that Visual Studio automatically wrote for this form. (Dramatic pause.) Wow! Look at all of that scary code. Actually, it’s not that bad. By the end of this book, you will have a firm grasp on all of it. Here in Chapter 1, it’s not really necessary to comprehend it all, but there are a few interesting lines to note. I’m including line numbers to make it easier to find the matching code in Visual Studio. If you want to view line numbers in Visual Studio (Professional Edition instructions listed here):

1. Select the Tools -> Options menu item to display Visual Studio’s options.

2. Select Text Editor -> Basic -> Editor from the tree-view to the left. If the Show all settings field is checked, the last component in the tree-view will be General, not Editor.

3. Select (check) the Line Numbers field on the right.

4. Click OK to apply the changes.

If you’re new to Visual Basic or .NET programming, don’t worry now if all this code doesn’t make sense; it will all become clear as you pass through the pages of this book.

 1 <Global.Microsoft.VisualBasic.CompilerServices. _
    DesignerGenerated()> _
 2 Partial Public Class Form1

20 <System.Diagnostics.DebuggerNonUserCode()> _
21 Protected Overloads Overrides Sub Dispose _
    (ByVal disposing As Boolean)

These lines show attributes in action. These two attributes (DesignerGenerated and DebuggerNonUserCode) are somewhat like the Obsolete attribute discussed earlier, in that they provide some informational identity to the related code. DesignerGenerated modifies the entire section of Form1‘s code, while DebuggerNonUserCode only modifies the Dispose member. For clarity, both attributes include their full namespace paths. The Global keyword at the beginning of the DesignerGenerated attribute is actually a Visual Basic keyword that says, “Start at the very tippy-top of the namespace hierarchy; this is not a relative path.”

 2 Partial Public Class Form1

Did you see the word Partial right there on line 2? I know I did. Hey, wait a minute; “Public Class Form1” also appeared in the Form1.vb file, but without the Partial keyword. Visual Basic 2005 includes a new feature that lets you divide a single class (Form1 in this case) among multiple source code files by including the Partial keyword with at least one of the parts. Pretty cool, eh? It allows Visual Studio to add complex initialization code for your form (as found in this Form1.Designer.vb file) without it bothering your main source code file (Form1.vb).

 3 Inherits System.Windows.Forms.Form

The Inherits keyword defines the inheritance relationship between this new Form1 class and the previously written System.Windows.Forms.Form class. Form is the “base” class, while Form1 is the “derived” class; Form1 inherits all of the functionality of the Form class, including its initial look and feel. I’ll discuss these class relationships in more detail in Chapter 8.

44 Friend WithEvents Button1 As System.Windows.Forms.Button

Line 44 defines the Go Ahead, Click Me button that appears in the center of the form. All controls that appear on your form are separate instances of classes. (Friend is a declaration statement described in the next chapter.) The WithEvents keyword indicates that this instance of the Button class will respond to events, such as a user clicking on it with the mouse. This line doesn’t actually create an instance of the Button class; that happens back on line 22.

22 Me.Button1 = New System.Windows.Forms.Button

The New keyword creates new instances of classes. In this case, that new instance is assigned to the Button1 class member defined on line 44. At this moment, Button1 is a default instance of the Button class; it doesn’t have any of its custom settings, such as its size and position, or the Go Ahead, Click Me display text. All of that is set in lines 27 to 31.

27 Me.Button1.Location = New System.Drawing.Point(64, 104)
28 Me.Button1.Name = "Button1"
29 Me.Button1.Size = New System.Drawing.Size(152, 23)
30 Me.Button1.TabIndex = 0
31 Me.Button1.Text = "Go Ahead, Click Me!"

Finally, the button is “glued” onto the form on line 38.

38 Me.Controls.Add(Me.Button1)

This adds the Button1 instance to the list of Controls managed by Form1. The Me keyword used throughout this code refers to the Form1 class itself, so Me.Button1 refers to the Button1 class member specifically in the current Form1 class.

Most of the code in this file appears in the InitializeComponent member procedure.

21 Private Sub InitializeComponent()
    ...
43 End Sub

When Visual Basic creates an instance of Form1 to display on the screen, it calls the InitializeComponent procedure to do the work of adding the controls to the form. Actually, Visual Basic calls the form’s constructor, which in turn calls InitializeComponent. Constructors are special class members that perform any needed initialization on a class instance. They are called automatically by .NET each time a class instance is created. In Visual Basic, all constructors use the name New, as with the following code:

Friend Class ClassWithConstructor
  Public Sub New()
   ' ----- All initialization code goes here.

  End Sub
End Class

I’ll talk much more about constructors in Chapter 8, but for now, locate the constructor in the code for Form1. (Very long pause.) What? There is no constructor? So, if there isn’t a constructor, how is the InitializeComponent member ever called?

That’s what I’d like to know. Actually, when the Visual Basic compiler generates the IL code for Form1, it adds a constructor silently, a constructor that calls InitializeComponent. How about that! Why didn’t Microsoft simply include the constructor’s code right in the source code? It’s a simplicity-for-the-programmer thing. They needed to have a default constructor that would call InitializeComponent, but they didn’t want a conflict to arise if you added your own default constructor in the non-Designer file. So they hid all of the code until it came time to actually compile the form. Clearly, it’s all rather hush-hush, so let’s move on.

Well, that’s pretty much the entire code, at least the part that matters to us now. Although we will rarely, if ever, examine the Visual Studio-generated code for the forms in the Library project, it’s good to see what’s going on behind the scenes. If you were a Visual Basic 6 programmer, you probably looked at the source code for your forms through Notepad at one time or another. If you did, you noticed that the form and all of its controls were defined with a hierarchy of special commands, and not with actual Visual Basic code. In .NET, that’s all changed; the form and all of its controls are created with ordinary Visual Basic code, so you can access it all and see what is really going on.

Example

<?php
($x=$y)?$x=5:$x=0;
//Equavalent
if($x=$y)
     $x=5;
else
     $x=0;
?>

Code:

<?
    $ip=getenv(REMOTE_ADDR);
    print  “Your IP Address is $ip”;
?> 

ผลลัพธ์ที่ได้คือ

Code:

Your IP Address is 127.0.0.1

จะเห็นได้ว่าโปรแกรมนี้สามารถตรวจสอบ IP Address ของผู้ใช้ได้ในระดับหนึ่ง แต่จะมีปัญหาในกรณีที่เครื่องผู้ใช้ได้ทำการปรับแต่งเครื่องให้ใช้ Proxy Server ซึ่งแทนที่เราจะได้ IP Address ของเครื่องผู้ใช้ เราก็จะได้รับ IP Address ของ Proxy Server แทน หรือในบางกรณีเราอาจจะได้ IP Address ของ Cache Server ของ ISP ที่ผู้ใช้ได้ใช้บริการอยู่ ดังนั้น ในกรณีที่เกิดเหตุการณ์นี้ตัวแปร REMOTE_ADDR จะไม่ได้เก็บ IP Address ที่แท้จริงของเครื่องผู้ใช้แต่จะเก็บ IP Address ของ Proxy Server หรือ Cache Server และจะเกิดตัวแปร HTTP_X_FORWARDED_FOR ขึ้นมา ซึ่งจะเป็นตัวแปรที่เก็บ IP Address ที่แท้จริงของเครื่องผู้ใช้แทน ดังนั้นเราจะทำการแก้โปรแกรมข้างต้นของเราเพื่อให้เก็บ IP Address ได้อย่างถูกต้อง ดังนี้

Code:

<?php
    if (getenv(HTTP_X_FORWARDED_FOR))
        $ip=getenv(HTTP_X_FORWARDED_FOR);
    else
        $ip=getenv(REMOTE_ADDR);
    print “Your IP Address is $ip”;
?>

ในโปรแกรมของเรานั้นเริ่มต้น เราจะทำการเช็คดูก่อนว่าตัวแปร HTTP_X_FORWARDED_FOR นั้นมีการเซ็ตไว้หรือเปล่า ถ้ามีการเซ็ตไว้แสดงว่ามีการใช้ Proxy Server หรือ Cache Server ดังนั้นตัวแปร HTTP_X_FORWARDED_FOR ก็จะเก็บ IP Address ที่แท้จริงไว้ ดังนั้นเราก็จะใช้ค่าจากตัวแปรนี้ แต่ถ้าไม่มีการเซ็ตตัวแปรนี้ไว้ เราก็จะเก็บค่า IP Address จากตัวแปร REMOTE_ADDR ตามปกติ
สำหรับชื่อของ Predefined Variable ที่เราใช้ในที่นี้คือ REMOTE_ADDR และ HTTP_X_FORWARDED_FOR อาจจะมีชื่อที่แตกต่างกันไปได้ ขึ้นอยู่กับว่าเราใช้เว็บเซิร์ฟเวอร์อะไร โดยในที่นี้เราจะอ้างอิงจาก Apache Webserver เป็นหลัก โดยถ้าเราใช้ [/b]Web Server อื่นนอกจาก Apache และต้องการตรวจสอบว่ามี Predefined Variable อะไรบ้างก็สามารถตรวจสอบได้ โดยใช้ฟังก์ชัน phpinfo() เพื่อตรวจสอบดังนี้

Code:

<?
    phpinfo();
?> 

โดยฟังก์ชันนี้จะแสดงตัวแปรที่เป็น Predefined Variable ทั้งหมดออกมา

For example, if you run the command is_file(“myfile.txt”) nad myfile.txt does not exist, you get a warning message. If you run @is_file(“myfile.txt”) you wont get this warning message.

คือทำให้ไม่แสดง Warning และ Error ถ้ามันเกิดขึ้น

Change the CSS code for h2 to the following:

h2 {
font-size: 1.5em;
background-color: #ccc;
margin: 1em;
padding: 3em;
}

You will see that this leaves one-character width space around the secondary header and the header itself is fat from the three-character width padding.

The four sides of an element can also be set individually. margin-top, margin-right, margin-bottom, margin-left, padding-top, padding-right, padding-bottom and padding-left are the self-explanatory properties you can use.

The Box Model

Margins, padding and borders (see next page) are all part of what’s known as the Box Model. The Box Model works like this: in the middle you have the content area (let’s say an image), surrounding that you have the padding, surrounding that you have the border and surrounding that you have the margin. It can be visually represented like this:

You don’t have to use all of these, but it can be helpful to remember that the box model can be applied to every element on the page, and that’s a powerful thing!

from: http://htmldog.com/

1. Use $_SERVER['PHP_SELF'] as a form action.

The $_SERVER auto-global array holds various useful server- and request-specific info. The PHP_SELF element of $_SERVER holds the filename of the currently executing script (relative to your web site’s document root directory). So, supplying $_SERVER['PHP_SELF'] as the action attribute of the form tag makes the form submit to the same page that displayed it. This lets you put the logic to handle the form in the same page as the logic that displays it. For many simple forms, this keeps things easy to manage.

2. Put [] at the end of the name of a multivalued form parameter.

When you’ve got a form element like <select multiple> that can submit multiple values to the server, put [] at the end of the form element name so that the PHP interpreter knows to accept multiple values.

For example, consider this form:

<form method="POST"  action="<?php echo $_SERVER['PHP_SELF']; ?>">
Pick some desserts: <select name="sweet[]" multiple>
<option value="puff"> Sesame Seed Puff</option>
<option value="square"> Coconut Milk Gelatin Square</option>
<option value="cake"> Brown Sugar Cake</option>
<option value="ricemeat"> Sweet Rice and Meat</option>
</select>
<input type="submit" name="Order">
</form>

If you pick Sesame Seed Puff and Brown Sugar Cake and submit the form, then $_POST['sweet'] is itself an array. $_POST['sweet'][0] is puff and $_POST['sweet'][1] is cake. That’s because the name attribute of the <select> element is sweet[]. If the name was just sweet, then $_POST['sweet'] would be a string, holding only one of the selected values.

3. Test for form submission with a hidden element.

Include a hidden variable named, say, _submit_check in your forms like this:

<input type="hidden" name="_submit_check" value="1"/>

Then, to test whether the form has been submitted, look for the _submit_check element in $_POST:

if (array_key_exists('_submit_check', $_POST)) {
     /* ... do something with the form parameters ... */
}

Testing for the presence of a hidden element avoids problems that can result from browsers’ varying behaviors when a user submits a form by pressing the Enter key instead of clicking a submit button.

4. Divide your form handling into three parts: showing, validating, and processing.

Logically, the life cycle of a web form usually comprises three steps: showing the form, validating the submitted form parameters, and then processing the submitted form parameters to generate appropriate output.

Dedicate a function to each of these steps: showing, validating, and processing. With this modular design, deciding when each step needs to happen is straightforward.

On many pages, the logical flow goes like this:

• If the request isn’t a form submission, show the form.
• If the request is a form submission, validate the submitted parameters.
• If the submitted parameters are valid, process them.
• If the submitted parameters are invalid, show the form.

With a function-based structure, the code to accomplish this looks something like:

if (array_key_exists('_submit_check',$_POST)) {
     // If validate_form() returns errors, pass them to show_form()
     if ($form_errors = validate_form()) {
         show_form($form_errors);
     } else {
         // The submitted data is valid, so process it
         process_form();
     }
} else {
     // The form wasn't submitted, so display
     show_form();
}

The page either displays the form (possibly with error messages) or displays the results of processing the form.

On other pages, particularly search pages, the logical flow goes like this instead:

• If the request is a form submission, validate the submitted parameters.
• Display the form.
• If the request is a form submission, process the submitted parameters.

With a function-based structure, the code to accomplish this looks something like:

// Check for errors if the form was submitted
$form_errors = array_key_exists('_submit_check',$_POST) ?
                validate_form() : null;

// Always display the form
show_form($form_errors);

// Display results if the form was submitted
if (array_key_exists('_submit_check', $_POST)) {
     process_form();
}

Displaying the form above the processing output is useful for pages where users might want to adjust the form parameters based on the results. For example, if a product search for toasters that cost between $150 and $300 reveals only two choices, a user can adjust the price range and resubmit the form for a new search without going to a separate page.

5. Validate numbers with strval() and intval() or floatval().

Usually, the ability to switch a variable smoothly between holding a string or a number is a great convenience in your PHP programs. However, that makes form validation a little harder. To check whether a submitted form parameter is a valid integer, use strval() and intval() together like this:

if ($_POST['age'] != strval(intval($_POST['age'])) {
     $errors[] = 'Please enter a valid age.';
}

If $_POST['age'] isn’t an integer, then intval() changes its value to something else. Adding strval() to the mix ensures that the comparison using the != operator doesn’t do any silent, behind-the-scenes conversion.

Similarly, to check whether a submitted form parameter is a valid floating-point number, use floatval() instead of intval():

if ($_POST['price'] != strval(floatval($_POST['price']))) {
     $errors[] = 'Please enter a valid price.';
}

6. Entity-escape form data before printing it.

Printing data that comes from an external source (like form input) without properly encoding it leaves you vulnerable to the common, devastating, and embarrassing "cross-site scripting attack."

Pass external data through htmlentities() before printing it, like this:

print "Your monkey's name is: " .
htmlentities($_POST['monkey_name']); 

Read more about cross-site scripting at http://www.owasp.org/documentation/topten/a4.html.

7. Print form elements’ defaults with helper functions.

Printing out appropriate HTML for individual form elements is boring and repetitive. Fortunately, computers are quite good at boring and repetitive tasks. Encapsulate logic for printing HTML form elements in functions. Then, call those functions whenever you need to print a form element. Chapter 6 of Learning PHP 5 includes functions for a number of form elements. Here are a few samples:

// print a single-line text box
function input_text($element_name, $values) {
     print '<input type="text" name="' . $element_name .'" value="';
     print htmlentities($values[$element_name]) . '">';
}

//print a textarea
function input_textarea($element_name, $values) {
     print '<textarea name="' . $element_name .'">';
     print htmlentities($values[$element_name]) . '</textarea>';
}

//print a radio button or checkbox
function input_radiocheck($type, $element_name,
                           $values, $element_value) {
     print '<input type="' . $type . '" name="' .
           $element_name .'" value="' . $element_value . '" ';
     if ($element_value == $values[$element_name]) {
         print ' checked="checked"';
     }
     print '/>';
}

//print a submit button
function input_submit($element_name, $label) {
     print '<input type="submit" name="' . $element_name .'" value="';
     print htmlentities($label) .'"/>';
}

These functions are called like this:

print '<form method="POST" action=" . $_SERVER['PHP_SELF'] . '">';
print 'Name: '; input_text('name', $_POST);
print '<br/>';
print 'Description: ';
input_textarea('description', $_POST);
print '<br/>';
print 'Advanced?';
input_radiocheck('check','editor', $_POST, 'yes');
print '<br/>';
print 'Size: Big ';
input_radiocheck('radio','size', $_POST, 'big');
print ' Small ';
input_radiocheck('radio','size', $_POST, 'small');
print '<br/>';
input_submit('submit', 'Save');

The functions are easily extendable to add your own layout or support for arbitrary attributes for each element.

8. Investigate HTML_QuickForm for advanced form processing.

For more advanced form handling, check out the PEAR module HTML_QuickForm. It provides methods for the flexible and structured creation, validation, and display of HTML forms. HTML_QuickForm frees you from doing the grunt work of displaying defaults for form elements, encoding HTML entities, and duplicating validation code. Its built-in layout engine is customizable, and you can integrate with template engines like Smarty.