Web Designing

Group A: Multiple Choice Questions (2 × 10 = 20 Marks)

To secure full marks in Group A, candidates must state the correct option and provide a concise, theoretically sound justification citing standard PHP/MySQL mechanics.

2. PHP Comments, CodeIgniter Intro, & PHP Advantages (3+2+3 Marks)

a) Comments in PHP

Comments in server-side scripting are block lines ignored by the interpreter engine, allowing developers to annotate, document, and debug source code without affecting runtime execution.

<?php
// 1. Single-Line Comment: Used for quick annotations.
$totalPrice = 500; # Alternative Shell/Perl style single-line comment

/* * 2. Multi-Line Comment:
 * Ideal for detailing complex algorithm logic,
 * documenting class behaviors, or disabling blocks of code.
 */
function processTransaction($amount) {
    return $amount * 1.18; // Adds a standard 18% tax
}
?>

b) What is CodeIgniter?

c) Key Advantages of Using PHP

• Open-Source & Free: PHP is free to download, use, and modify under the PHP License, backed by global enterprise development.
• Cross-Platform Independence: Code runs natively across leading hosting environments, operating systems (Linux, Windows, macOS), and web servers (Apache, Nginx, IIS).
• Vast Ecosystem & Support: Seamlessly integrates with multiple relational databases (MySQL, PostgreSQL, Oracle) and boasts a large pool of libraries, documentation, and developers.
• Speed & Resource Efficiency: Modern PHP (PHP 8.x+) features highly efficient memory usage, optimized JIT compilation, and fast execution speeds compared to other interpreted server-side languages.

3. SQL Injection Attacks & Defenses (6+2 Marks)

a) Mechanism of SQL Injection (SQLi)

Consider an unsafe user authentication check that dynamically concatenates values:

If an attacker inputs admin' OR '1'='1 into the username field, the compiled query processed by the database engine becomes:

Because the condition '1'='1' is always true, the SQL command bypasses authentication checks and retrieves user records, often exposing sensitive administrator controls.

b) Prevention Strategies

1. Prepared Statements (Parametrized Queries): Pre-compiles the query on the database server. Inputs are treated strictly as parameters, preventing the interpreter from treating user input as executable SQL commands.
2. Input Validation & Sanitization: Implement strict type casting and filter incoming inputs (e.g., ensuring numeric IDs are cast using (int) or validated using filter_var()).

<?php
// Secure PDO Implementation preventing SQL Injection
$stmt = $pdo->prepare('SELECT id, username FROM users WHERE email = :email');
$stmt->execute(['email' => $userInputEmail]);
$userData = $stmt->fetch();
?>

4. PHP Array Types & String Splitting (4+4 Marks)

a) Types of Arrays in PHP

b) Splitting a String in PHP

PHP provides native functions to divide strings based on character boundaries (str_split()) or target delimiters (explode()).

<?php
$inputString = "Hypertext,PreProcessor,Server,Side";

// Split string by a specific delimiter using explode()
$arrayData = explode(",", $inputString);
print_r($arrayData);
/* Output:
Array (
    [0] => Hypertext
    [1] => PreProcessor
    [2] => Server
    [3] => Side
) */

// Split string into 4-character chunks using str_split()
$chunks = str_split("PHPENGINE", 3);
print_r($chunks);
/* Output:
Array (
    [0] => PHP
    [1] => ENG
    [2] => INE
) */
?>

5. PHP Sessions & E-Commerce Fundamentals (2+3+3 Marks)

a) What is a PHP Session?

<?php
// Step 1: Initialize/join the active session.
session_start();

// Step 2: Unset all active global session variables in memory.
session_unset();

// Step 3: Completely destroy the physical session file/data on the server storage.
session_destroy();

// Step 4: Optional: Overwrite cookie reference client side
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

echo "All session variables successfully erased and destroyed.";
?>

b) What is E-Commerce?

Electronic Commerce (E-Commerce) refers to the purchase, sale, exchange, and transaction of goods, services, or data over electronic networks, primarily the internet.

6. Cookies & State Comparison in PHP (3+3 Marks)

a) What is a Cookie?

<?php
// To delete a cookie, set its expiration date to a time in the past.
// The name, path, and domain parameters must match the original configuration.
setcookie("username", "", time() - 3600, "/");

echo "Cookie 'username' has been marked for deletion.";
?>

b) Structural Comparison: Session vs. Cookie

7. MySQL Integrations, HTTP Methods, & DB Operations (2+2+4 Marks)

a) MySQL Usage with PHP and HTTP Method Differences

Why MySQL with PHP? MySQL is highly integrated with PHP due to its open-source synergy (historically forming the foundation of the LAMP/WAMP stack). It provides native extensions, object-oriented APIs like PDO, and scalable storage mechanisms designed for high-concurrency dynamic web applications.

b) Form Data Insertion Script (Secure PDO Standard)

This script securely handles incoming POST data and uses prepared statements to write to the database, preventing SQL injection vulnerabilities.

<?php
// Database configuration parameters
$host    = 'localhost';
$dbName  = 'user_registry';
$dbUser  = 'root';
$dbPass  = 'secure_password';
$charset = 'utf8mb4';

$dsn = "mysql:host=$host;dbname=$dbName;charset=$charset";
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
];

try {
    // Establish connection to database via PDO
    $pdo = new PDO($dsn, $dbUser, $dbPass, $options);
} catch (\PDOException $e) {
    die("Database Connection Failure: " . $e->getMessage());
}

// Process incoming POST form submission safely
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $fullName = trim($_POST['fullName'] ?? '');
    $userEmail = trim($_POST['userEmail'] ?? '');

    // Validate inputs
    if (!empty($fullName) && filter_var($userEmail, FILTER_VALIDATE_EMAIL)) {
        // Prepare the SQL insert statement
        $sql = "INSERT INTO subscribers (name, email) VALUES (:name, :email)";
        $stmt = $pdo->prepare($sql);

        try {
            // Execute the prepared statement with parameter binding
            $stmt->execute([
                ':name'  => $fullName,
                ':email' => $userEmail
            ]);
            echo "Registration Completed Successfully.";
        } catch (\PDOException $e) {
            echo "Error Inserting Data: " . $e->getMessage();
        }
    } else {
        echo "Invalid Form Input Data.";
    }
}
?>

8. Dynamic Web Architectures, Imports, & Query Sorting (2+2+4 Marks)

a) Dynamic Websites & PHP File Imports

b) The MySQL ORDER BY Clause

The ORDER BY clause sorts the returned records in ascending (ASC) or descending (DESC) order based on one or more columns.

-- Sort products by price in descending order, and secondary sort by name ascending
SELECT id, name, price, stock
FROM catalog_items
WHERE stock > 0
ORDER BY price DESC, name ASC;

9. Framework Demands & CodeIgniter MVC Architecture (2+1+5 Marks)

a) Why Use a PHP Framework?

Enterprise applications rarely rely on raw "vanilla" procedural PHP. Frameworks provide several benefits:

• Standardization: Enforces the Model-View-Controller (MVC) pattern, ensuring clean separation of concerns and maintainable codebases.
• Rapid Development: Built-in components handle common needs such as database migrations, routing, session management, and validation.
• Security Defenses: Offers built-in protection against common security risks, including Cross-Site Scripting (XSS), SQL Injection (SQLi), and Cross-Site Request Forgery (CSRF).

Popular Frameworks: Laravel, CodeIgniter, Symfony, Yii, and CakePHP.

b) The CodeIgniter MVC Paradigm

CodeIgniter uses a clean implementation of the Model-View-Controller pattern, enforcing a separation between business logic, database queries, and the presentation layer.

10. Scholarly Short Notes (Answer any two: 4 + 4 Marks)

a) AJAX (Asynchronous JavaScript And XML)

AJAX is a development technique used to construct fast, dynamic user interfaces. It enables web pages to update content asynchronously by exchanging data with a backend server in the background, avoiding the need to reload the entire page.

• Core Mechanics: Uses client-side JavaScript interfaces like Fetch API or XMLHttpRequest to send background requests and dynamically render the returned JSON/XML payloads using DOM manipulation.
• UX Impact: Minimizes server-side processing overhead and eliminates full-page reloads, providing a more responsive user experience similar to desktop applications.

b) Content Management System (CMS)

A CMS is a software application or suite of tools that allows users to create, organize, edit, and publish digital web content without needing to write backend source code manually.

• Separation of Content and Presentation: CMS engines isolate the stored layout designs (themes) from the underlying SQL content tables, making structural updates easy.
• Key Components: Typically includes a Content Authoring Environment (CAE) for editing and a Content Delivery Application (CDA) to dynamically render and publish pages to visitors.
• Examples: WordPress, Drupal, Joomla, and headless alternatives like Strapi.

c) PDO (PHP Data Objects)

PDO is a lightweight, consistent database abstraction layer for PHP. It defines a uniform, object-oriented API for interacting with databases, allowing developers to switch the underlying storage system (e.g., from MySQL to PostgreSQL or SQLite) without major code rewrites.

• Security Defenses: Features built-in protection against SQL injection via parameterized prepared statements.
• Error Handling: Implements robust, catchable exceptions (PDOException), improving error logging and security compared to older procedural drivers like mysql_*.

Web Designing Past Paper Solutions · Hand-crafted Exam Notes · Aligned with May 2025 Syllabus Guidelines.