Web Designing

Group A: Short Answer Questions (Answer any Five: 3 × 5 = 15 Marks)

To secure maximum marks in Group A, candidates must provide clear explanations along with correct syntaxes and standard architectural rationale.

2. Static vs. Dynamic Websites & PHP Core Advantages (5+4 Marks)

a) Structural Comparison: Static vs. Dynamic Websites

Websites are categorized based on how their pages are compiled and served to visitors. Below is an academic breakdown of static and dynamic website architectures:

b) Key Advantages of Using PHP

PHP (Hypertext Preprocessor) is a widely used server-side language that offers several distinct benefits for modern web development:

• Open-Source and Cost-Effective: PHP is free to download, use, and modify under the PHP License, allowing developers to build and scale applications without licensing overhead.
• Cross-Platform Portability: PHP runs natively on all major operating systems (Linux, Windows, macOS, Unix) and is fully compatible with popular web servers like Apache, Nginx, and IIS.
• Vast Database Connectivity: It provides built-in extensions (such as PDO and MySQLi) that make it easy to connect and communicate with different relational and non-relational databases.
• Strong Community Support: Backed by a large global community, providing comprehensive documentation, pre-built frameworks (like Laravel and CodeIgniter), and abundant security libraries.

3. HTTP GET vs. POST & Dynamic Form Rendering (4+5 Marks)

a) Differentiate between $_GET and $_POST Methods

In PHP, $_GET and $_POST are superglobal associative arrays used to retrieve user input submitted via HTML forms. They handle and transmit data differently:

b) PHP Script: Processing and Displaying Submitted Form Data

This script provides a clean implementation of a contact form. It uses the POST method, validates user input, and securely renders the submitted content on the page.

<?php
// Initialize output variables
$submittedName = "";
$submittedEmail = "";
$formSubmitted = false;

// Process the form submission
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    // Retrieve and sanitize inputs to prevent Cross-Site Scripting (XSS)
    $submittedName = htmlspecialchars(trim($_POST['username'] ?? ''));
    $submittedEmail = htmlspecialchars(trim($_POST['email'] ?? ''));

    if (!empty($submittedName) && !empty($submittedEmail)) {
        $formSubmitted = true;
    }
}
?>

<!-- HTML Interface Structure -->
<form action="" method="POST">
    <label for="username">Name:</label>
    <input type="text" id="username" name="username" required>

    <label for="email">Email:</label>
    <input type="email" id="email" name="email" required>

    <button type="submit">Submit Form</button>
</form>

<?php if ($formSubmitted): ?>
    <div class="key-point">
        <span class="klabel">Submitted Data Overview</span>
        <p><strong>Name:</strong> <?php echo $submittedName; ?></p>
        <p><strong>Email:</strong> <?php echo $submittedEmail; ?></p>
    </div>
<?php endif; ?>

4. Documentation via Comments & Variable Scopes (3+6 Marks)

a) Comments in PHP

Comments are non-executable annotations in source code that are ignored by the PHP interpreter. They are used to document code, explain complex logic, and help with debugging.

<?php
// 1. Single-Line Comment: Used for quick annotations or one-line explanations.
$activeTaxRate = 0.18;

# 2. Alternative Single-Line Comment: Unix shell-style comment.
$shippingCost = 45.00;

/* 3. Multi-Line Comment Block:
 * Used to document complex algorithms,
 * classes, or to temporarily comment out blocks of code during debugging.
 */
function calculateFinalTotal($price, $tax) {
    return $price + ($price * $tax);
}
?>

b) Accessing Global Variables Inside PHP Functions

In PHP, global variables (variables declared outside of functions) are not automatically accessible inside function scopes due to local isolation. To access them, developers must use one of the following methods:

<?php
$appVersion = "v3.1";

function displayVersion() {
    global $appVersion; // Imports global variable
    echo "Active Version: " . $appVersion;
}
?>

<?php
$databaseHost = "localhost";

function connectToDB() {
    // Accesses variable via the $GLOBALS array
    echo "Connecting to " . $GLOBALS['databaseHost'];
}
?>

5. Associative Array Architectures & File Imports (5+4 Marks)

a) Associative Arrays in PHP

<?php
// Initialize an associative array mapping student names to scores
$gradeBook = [
    "Alice" => 92,
    "Bob"   => 85,
    "Clara" => 97
];

// Display individual element value using its string key
echo "Clara's score: " . $gradeBook["Clara"] . "\n";

// Traverse the associative array using a foreach loop
foreach ($gradeBook as $studentName => $scoreValue) {
    echo "Student: $studentName | Grade: $scoreValue \n";
}
?>

b) Structural Difference: include vs. require Statements

PHP uses include and require statements to import and execute files within other scripts. They differ in how they handle missing files:

6. Session-Based Database Authentication & script Termination (7+2 Marks)

a) Complete PDO and Session Login System Implementation

This script implements a secure authentication workflow. It takes form input, queries a database table named User containing UserId and Password, and registers an active session if the credentials are valid.

<?php
// Start session to persist user state
session_start();

// Database connection configuration
$host   = "localhost";
$db     = "auth_vault";
$user   = "db_administrator";
$pass   = "strong_password";
$dsn    = "mysql:host=$host;dbname=$db;charset=utf8mb4";

try {
    $pdo = new PDO($dsn, $user, $pass, [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES   => false,
    ]);
} catch (PDOException $e) {
    die("Database Connection Error: " . $e->getMessage());
}

$errorMessage = "";

// Process form submission
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $inputUser = trim($_POST['userId'] ?? '');
    $inputPass = trim($_POST['password'] ?? '');

    if (!empty($inputUser) && !empty($inputPass)) {
        // Retrieve credentials using prepared statements to prevent SQL injection
        $stmt = $pdo->prepare("SELECT UserId, Password FROM User WHERE UserId = :userid");
        $stmt->execute([':userid' => $inputUser]);
        $userRecord = $stmt->fetch();

        // Verify password (assumes password was hashed using password_hash())
        if ($userRecord && password_verify($inputPass, $userRecord['Password'])) {
            // Save authenticated state to session variables
            $_SESSION['authenticated_user'] = $userRecord['UserId'];
            $_SESSION['login_time'] = time();

            // Redirect user to the secure dashboard page
            header("Location: dashboard.php");
            exit();
        } else {
            $errorMessage = "Invalid User-ID or Password.";
        }
    } else {
        $errorMessage = "Please fill in all credentials.";
    }
}
?>

<!-- HTML Authentication Interface -->
<form action="" method="POST">
    <h3>Secure Login Portal</h3>
    <?php if (!empty($errorMessage)): ?>
        <div class="warning"><span class="wlabel">Error</span><?php echo $errorMessage; ?></div>
    <?php endif; ?>

    <label for="userId">User-ID:</label>
    <input type="text" id="userId" name="userId" required>

    <label for="password">Password:</label>
    <input type="password" id="password" name="password" required>

    <button type="submit">Login</button>
</form>

b) Use of the die() Function in PHP

Primary Use Cases:

• Graceful Error Handling: Terminates the script and displays an error message if a critical resource (such as a database connection or file) is missing or inaccessible.
  $conn = mysqli_connect(...) or die("Failed to connect to database.");
• Security Defenses: Halts execution immediately after issuing redirect headers to prevent unauthorized client requests from accessing protected logic.
  header("Location: login.php"); die();

7. File System Streams & HTTP Header Redirection (6+3 Marks)

a) PHP Script: Opening and Displaying File Content Securely

This script securely opens a text file named system_logs.txt in read-only mode, processes its contents line-by-line using a loop, and then releases the file resource.

<?php
$targetFile = "system_logs.txt";

// Verify file existence and readability before opening
if (file_exists($targetFile) && is_readable($targetFile)) {
    // Open the file in read-only mode ('r')
    $fileHandle = fopen($targetFile, "r");

    if ($fileHandle !== false) {
        echo "<h4>Displaying Content of File: " . htmlspecialchars($targetFile) . "</h4>";
        echo "<pre style='background: var(--paper-2); padding: 1rem; border-radius: 4px;'>";

        // Loop through the file line by line until the end-of-file (feof) is reached
        while (!feof($fileHandle)) {
            $lineContent = fgets($fileHandle);
            // Sanitize output to prevent cross-site scripting (XSS)
            echo htmlspecialchars($lineContent);
        }

        echo "</pre>";

        // Close the file stream to release the system resource
        fclose($fileHandle);
    } else {
        echo "Unable to open the specified file stream.";
    }
} else {
    echo "The file does not exist or is not readable by the system.";
}
?>

b) HTTP Header Redirection in PHP

Web page redirection is performed by sending a raw HTTP Location header to the client's browser. This is done using the header() function.

<?php
// 1. Send the HTTP Location redirect header
header("Location: https://www.universityportal.edu/dashboard");

// 2. Always follow a redirect header with exit() or die()
// This prevents the server from executing subsequent code for unauthorized clients.
exit();
?>

8. MVC Frameworks & CodeIgniter Request Lifecycle (2+7 Marks)

a) What is CodeIgniter?

b) CodeIgniter Request Lifecycle Architecture

The internal request lifecycle of CodeIgniter defines how an incoming HTTP request is routed, filtered, processed, and returned to the client. This centralized process ensures consistent performance and secure access controls.

The sequential execution lifecycle consists of the following steps:

1. Entry Point (index.php): All incoming client requests are routed through index.php, which initializes core framework variables and loads base configuration classes.
2. Routing Engine Check: The Routing module parses the request URL to determine which Controller and method should process it. It first checks the Caching Engine: if a cached copy of the page exists, it is sent directly to the client, bypassing the standard controller execution for optimal speed.
3. Security Filter Inspection: Before loading the Controller, the request is passed through built-in security filters. These inspect inputs for threats and apply defenses against CSRF, SQL Injection, and XSS.
4. Controller Execution: The Controller loads and initializes Models (database resources), processes application logic, and binds the structured datasets to Views.
5. View Rendering & Output: The finalized View generates the final HTML output, which is written to the Output class buffer and sent back to the client's browser.

Web Designing Past Paper Solutions · Hand-crafted Exam Notes · Aligned with July 2023 Syllabus Guidelines.