Tutorial Web Programming Final
Tutorial Web Programming Final
CSS: Stands for "Cascading Style Sheet." is a language for specifying how documents
are presented to users.
XSL: Extensible Stylesheet Language. An XSL style sheet is, like with CSS, a file that
describes how to display an XML document of a given type.
XSLT: (Extensible Stylesheet Language Transformations) it is a language for
transforming XML documents into other XML documents, or other formats such as
HTML for web pages, plain text or into XSL Formatting Objects, which may
subsequently be converted to other formats, such as PDF PostScript and PNG.
SASS: Sass is an extension of CSS3, adding nested rules, variables, mixins, selector
inheritance, and more. It's translated to well-formatted, standard CSS using the
command line tool or a web-framework plugin.
2. Give with examples, three 4 differences between HTML and XHTML
HTML XHTML
These elements are void elements in HTML. XHTML elements must be
properly nested
In HTML elements are parsed as RCDATA elements XHTML elements must always
be closed
In HTML elements are parsed as CDATA elements. XHTML elements must be in
lowercase
. html, .htm .xhtml, .xht, .xml, .html, .htm
application/xhtml+xml
Versions HTML 2, HTML 3.2, HTML 4.0, HTML 5. Versions XHTML 1, XHTML 1.1,
XHTML 2, XHTML 5.
3. List five elements in HTML5 that are not in HTML4
aside represents a piece of content that is only slightly related to the rest of the
page.
footer represents a footer for a section and can contain information about the
author, copyright information, etc.
<html>
<head>
<title>Creating MySQL Database</title>
</head>
<body>
<?php
$dbhost = 'localhost:3036';
$dbuser = 'root';
$dbpass = 'rootpassword';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully<br />';
$sql = 'CREATE DATABASE TUTORIALS';
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
die('Could not create database: ' . mysql_error());
}
echo "Database TUTORIALS created successfully\n";
mysql_close($conn);
?>
</body>
</html>
(c) Write a script in php, jsp or asp that could be used to insert data from this form
into the database.
<?php
//database connection
$connection = mysql_connect("localhost", "root", "finishing");
//testing connection
if ($connection) {
$db = mysql_select_db("books");
print "Connected.\n";
if (!$db) print "Failed to select 'phpdb'.\n";
}
else {
print "Failed to connect to database";
}
//Insert Query
$sql2 ="INSERT INTO
`reg`
(
`fname` ,
`lname` ,
`age` ,
`gender` ,
`region` ,
`condition`
)
VALUES
(
'".$_POST['name']."' ,
'".$_POST['sex']."' ,
'".$_POST['age']."' ,
'".$_POST['sex']."' ,
'".$_POST['region']."' ,
'".$_POST['condition']."'
)";
$result2 = mysql_query( $sql2 )
or die("Invalid query: " . mysql_error());
?>
(d) Write a script in php, jsp or asp and to retrieve these data and display them on
an html table.
<html>
<head>
</head>
<body>
<?php
// Database connection
$connection= mysql_connect('localhost','root','finishing');
//Testing DB
if($connection)
{
$selection=mysql_select_db('input');
else
die('unable to connect'.mysql_error);
$result=mysql_query($sqltable);
$row=mysql_fetch_array($result,MYSQL_ASSOC);
if(mysql_num_rows($result)>0){
while($row){
echo"<table border='1'>
<td>".$row['fname']."</td>
<td>".$row['lname']."</td>"
<td>".$row['age']."</td>
<td>".$row['gender']."</td>"
<td>".$row['region']."</td>
<td>".$row['condition']."</td>";
}
?>
</body>
</html>
5. How would you prevent SQL injection in your php, jsp or asp script?
To prevent SQL injections we will have to use something called prepared statements,
which uses bound parameters. Prepared Statements do not combine variables with
SQL strings, so it is not possible for an attacker to modify the SQL statement. Prepared
Statements combine the variable with the compiled SQL statement, this means that
the SQL and the variables are sent separately and the variables are just interpreted as
strings, not part of the SQL statement
6. How would you prevent cross-site scripting in your php, jsp or asp script?
• Never pass data from untrusted origins into output without either escaping or
sanitising it.
• Never forget to validate data arriving from an untrusted origin using relevant rules
for the context it’s used in.
• Remember that anything not explicitly defined in source code has an untrusted
origin.
• Remember that htmlentities() is incompatible with XML, including HTML5’s
XML serialisation – use htmlspecialchars().
7. Write a javascipt (using regular expressions) code that would display a dialog if a
user enters a non-numeric character in a textfield.
<?php
// javascript windows message
if(mysql_query($check_user)>0{
echo
"<script>windows.open ('welcome.php','_self' ) </script>";
}
else{
echo"<script>alert ( ' Data entered is incorrect ! ' )</script>";
}
update code:
$sql = "UPDATE MyGuests SET lastname='Doe' WHERE id=2";