When submitting sensitive information over the web it’s important to ensure that the requested page is being accessed via an HTTPS encrypted connection. I’ve come across some forms that don’t check whether a secure connection has been made or not. In other words, you can delete the S from HTTP and instead of redirecting the user back to the HTTPS connection the form is just displayed unsecured. This is a BIG NO NO… as a programmer you cannot rely on the visitor, or even other developers who would be linking to the form, to request a form securely. In this post I will review how you can ensure that your users are accessing certain pages using a secure connection.

The Server Superglobal

How can you tell if your user is requesting a certain page using a secure connection (HTTPS)? Enter the PHP server surperglobal.

“$_SERVER is an array containing information such as headers, paths, and script locations. The entries in this array are created by the web server.”
- PHP Manual (http://www.php.net)

There are 2 elements within this array that you can check that will tell you whether the user has made a secure request or not: https and server_port.

Programmer Beware

Something to keep in mind is that each web server will provide or not provide certain information in the $_SERVER array depending on their configuration. The PHP manual also points this out:

“There is no guarantee that every web server will provide any of these; servers may omit some, or provide others not listed here.”
- PHP Manual (http://www.php.net)

So I guess that brings us back to the original question: how can you tell if your user is requesting a certain page using a secure connection (HTTPS)? Of the 2 elements mentioned above, server_port is part of the CGI 1.1 specification so the chances are good that element will be available in most servers. You can check for the availability of the https element if you wish but you should also include a check of the server_port as a fallback.

The Code

There is a good code example in the comments of the PHP manual of a function that checks whether or not the user has made a secure request:

<?php
function isSSL(){

if($_SERVER['https'] == 1) /* Apache */ {
return TRUE;
} elseif ($_SERVER['https'] == 'on') /* IIS */ {
return TRUE;
} elseif ($_SERVER['SERVER_PORT'] == 443) /* others */ {
return TRUE;
} else {
return FALSE; /* just using http */
}

}
?>

This example function makes use of both the https and server_port elements of the superglobal array and also takes into account the different values that might be provided based on the web server. The only thing I will mention about using the server_port element is to make sure you know what port your server is using for HTTPS connections. I believe 443 is the standard, but ports can be changed so you just want to make sure you are checking the correct port for your server.

What about CodeIgniter (CI)?

If your programming using CI, you could certainly put the function above in a helper and call it whenever necessary. Or, a technique I’ve used successfully in the past, is to put the check in a custom library and auto load it. When you do it this way the connection is tested every time a page is loaded automatically without you having to make any additional function calls. And instead of returning TRUE or FALSE you can simply redirect the user to the requested page using HTTPS instead of HTTP which truly automates the process.

One thing that can trip you up when making secure connections using CI is the address you’ve entered on line 14 of application/config/config.php. If you enter just a static address starting with HTTP then HTTP will be used when calling any URL helper function like site_url() or anchor(). To avoid this issue,  you can replace line 14 with the following code from the CI wiki:

$config['base_url'] = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on") ? "https" : "http");
$config['base_url'] .= "://".$_SERVER['HTTP_HOST'];
$config['base_url'] .= str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']); 

This code will automatically set the base_url config element so you don’t have to. This also comes in real handy when writing portable code that you want to distribute to other users or clients for installation on their own servers.

That’s a wrap

That does it for making sure your files are being accessed securely. If you have any questions or use a different technique for checking secure connections please share them by posting a comment.

Related posts:

1. Customizing Domains With Wildcard DNS
2. Implementing Facebook Connect (Part 3) – Accessing Data from Facebook
3. Generating PDF files using CodeIgniter

XFBML

Once you’ve established your connection to Facebook you now have access to a wide array of information, but to display this information you need to get familiar with Facebook Markup Language (FBML), an extension to HTML. The cool thing with FBML is that you can access a lot of information without a lot of code. All you need is the FBML tag in your HTML document and that’s that.

Rendering XFBML

In order to render XFBML tags on your page you first need to add the appropriate doctype and HTML attribute to your document.

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Strict//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd”> <html xmlns=”http://www.w3.org/1999/xhtml” xmlns:fb=”http://www.facebook.com/2008/fbml”>

The above mark-up is a standard doctype declaration. The only thing to note here is the XML namespace attributes added to the HTML tag. These are necessary in order to IE to render things appropriately so you don’t want to leave them out.

After you have the appropriate doctype declared you need to initialize the JavaScript Client Library from the Facebook site. This script basically contacts Facebook servers and tells them that you want to display FBML on the page in question and it’s up to Facebook to provide all the necessary tools to do so.

<script src="http://static.ak.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php" type="text/javascript"></script>

Finllay you need to send them your API key using the following script (which should be placed right after the above JavaScript include).

<script type="text/javascript">
FB_RequireFeatures(["XFBML"], function(){
FB.Facebook.init("YOUR_API_KEY_HERE", "<relative path from root>/xd_receiver.htm");
});
</script>

The Tags

OK, so now that we have the environment setup to recognize and render FBML we can review some of the tags and what they do.

<fb:login-button></fb:login-button>

The login-button tag should be familar from my last post. This tag renders a Facebook Connect log-in button on your site. When a user clicks the button they are presented with the Facebook log-in form in a pop-up window. When they log-in your application is added to their list of approved applications.

<fb:name uid=”user_id”>

The name tag does just what it’s mark-up would suggest, it displays the users name. This tag has one required attribute called uid where you need to provide a user id. You can also use this tag with Facebook Pages as well by passing the page id instead of the user id in the uid attribute. For more information about the name tag, visit the Developers Wiki.

<fb:pronoun uid=”user_id”>

The pronoun tag displays a pronoun for a specified user. Again, this tag has one required attribute uid for the user id. For more information about the pronoun tag, visit the Developers Wiki.

<fb:profile-pic uid=”user_id”>

The profile-pic tag can display a users Facebook profile picture in a number of different ways. After providing a user id for the uid attribute you can also specify a size (like thumb, small, pic_square, etc.). For more information about the profile-pic tag, visit the Developers Wiki.

<fb:grouplink gid=”group_id”>

The grouplink tag gives you the ability to display group page links using FBML.  Simply provide the group id for the gid attribute and your all set. For more information about the grouplink tag, visit the Developers Wiki.

<fb:eventlink eid=”event_id”>

The eventlink tag is similar to the grouplink tag except for events. Fed an event id for the eid attribute it will render a link to the specified events page within Facebook. For more information about the grouplink tag, visit the Developers Wiki.

<fb:serverfbml>

The serverfbml tag is a very powerful tag that allows you to render FBML on Facebooks servers within an iFrame on your page. Using this tag you can interact with Facebook data through forms and such and it all takes place on Facebooks servers for security reasons. For more information about the grouplink tag, visit the Developers Wiki.

Try it yourself!

For additional information about the tags mentioned here and others I would recommend checking out the Facebook Developers Wiki. You can try things out on your own, or Facebook provides a number of demo files available for download which use the tags mentioned above and others to help you get a better idea of what’s possible.

There is one post left in this series and I promise it won’t take me a month to post it. In this post we looked at accessing information from Facebook; in the final post we will look at sending information back to Facebook so stay tuned!

Related posts:

1. Implementing Facebook Connect (Part 2) – Establishing a Connection
2. Implementing Facebook Connect (Part 1) – What is Facebook Connect?
3. Facebook Connect Library for CodeIgniter

Introducing ScoutMailer

At Left of Center Communications (LOCC) my primary target market is the boy and girl scouting communities. My flagship product, BadgeTracker, is designed specifically for scout camps and Sign-Up-Sheet.com was first developed to help my local scout troop. So when it came time for me to figure out how I was going to sell CM it didn’t take me long to decide I would target it to the scouting community and thus ScoutMailer was born.

I choose to resell CM because the deal is just too good to pass up. There are no monthly fees, annual licensing fees or recurring fees of any kind. The only real long term cost is management time which isn’t that much thanks to CMs intuitive interface. Also, this isn’t just some referral or affiliate program that pays 20% – 30%. You can charge your clients whatever you want for the product. CM will take care of all the financial stuff and send you your cut at the end of every month via Paypal.

At the beginning of every new project I typically sit down and come up with a task list of things that need to be done in order to bring a new product to market. When I thought about ScoutMailer there really was only 4 things to do:

• Design logo and promotional site for scoutmailer.com domain.
• Write website content.
• Customize CM interface with colors and logos.
• Promote through existing add channels using BadgeTracker and Sign-Up-Sheet.com.

I outsourced the design of the logo and website so the only thing I needed to invest in that task was money. Writing the promotional website content was reasonably simple after seeing what other companies had done. Customizing CMs interface with my colors and logo was a simple 10 minute thing. Finally, promotion and marketing has really just begun. But that was it… less than 4 tasks to bring a new product to market.

The Promo Site

The biggest part to reselling CM is developing your own promotional materials. This process is really the same with any product, whether your the developer or just the reseller. The good news with CM is that they have a lot of resources available in the form of screenshots and how-to’s to help you along. I would also encourage you to take a look at the customers section of their website to see what other companies have done.

After about 2 weeks and some back and forth between myself and the designer we came up with the ScoutMailer promotional site:

Most all CM promotional sites are pretty much the same. They have the same site structure and content, but I wanted to make mine stand out a bit. So, I added a resources section to my site controlled by WordPress. My intention is to eventually develop some tutorials and how-to articles specifically for my group of users. The thing to remember about the promo site is you need to speak to your specific users. Put the product in terms that they will understand.

Customizing the Interface

The folks over at CM have written a helpful article to walk you through the process of rebranding their product to fit your needs. This was really the only “gotcha” moment in this whole process for me. They provide a set number of color schemes to choose from and that’s it. You can’t define your own colors. As a heads up, you might want to review those options before settling on a color scheme for your promo site/brand for CM so that your logo and site design goes with the interface. I had a bit of an issue with their shade of red but I think everything turned out OK.

Overcoming the Language Barrier

One of the issues I knew I would have to address in the promo site, and will probably have to work through in support requests, is the e-mail marketing terminology. My particular target market isn’t interested in an e-mail marketing tool… they are more looking for a mailing list management solution and the two don’t necessarily mean the same thing to them. They want something that let’s them send plain text reminders from time to time and maybe the odd HTML newsletter every so often… but that’s it!

Another issue that I foresee moving forward is that my user base probably won’t understand that campaign = e-mail message. There is going to be a bit of a language barrier that I’m going to have to deal with so that they understand the process. It would be totally cool if CM allowed us to customize the terminology used in the app someday. But for now I’m relying on my promo site to steer users in the right direction. I’m also thinking about potentially developing a glossary and posting that in the resources section to help. But it’s something for you to keep in mind depending on what audience you plan on marketing CM to.

What’s next?

ScoutMailer officially launched just this past Monday. Marketing and promotion is still getting underway but it will be interesting to see if I get any takers. Another opportunity for selling CM to existing customers is integrating your existing products with the CM API. I’m going to look into this later this year to see if theres any value there. Keep watch for a how-to post on that in the near future.

That’s my story… do you have one? If you have been reselling CM for a while or just started, let me know what your experience has been in the comments.

Related posts:

1. 10 Reasons Why Campaign Monitor Rocks
2. ScoutMailer Case Study

Getting Started

In order to use FC with your own application you first need to set your application up within Facebook so you can get your hands on an API key. As is the case when working with any API your API key will be used throughout your FC integration code for authentication purposes.

Step 1 – Add Facebook Developers to Your Applications

The first thing you need to do in order to set your application up within Facebook is add the Facebook Developers Application to your approved applications list. To do this, visit http://www.facebook.com/developers/. Once you have added the developers application to your authorized applications list you will have access to all the developer resources that Facebook has to offer as well as a discussion board for questions and issues.

Step 2 – Setup Your Application

Now that you have added the developers application to your authorized applications list you can now proceed with setting your application up.

Navigate back to the Facebook Developers application by visiting http://www.facebook.com/developers/ and click the Set Up New Application button at the top right of the window.

Now comes the fun part… setting up an application in Facebook involves a mega-form full of options and other required pieces of information. The form is fairly self-explanitory so I won’t take the time to go through it all with you. The only thing I will point out is the Connect tab. This section of the form concerns all the FC settings as they relate to your application. The only thing you need to concern yourself with at this point is the Base Domain field. “Specifying a base domain allows you to make calls using the PHP and JavaScript client libraries as well as get and store session information for any subdomain of the base domain.” Enter all the necessary information about your application and click Save Changes.

Establishing a Connection

Now that we have our API keys we can put the files in place that will help us establish a connection between our application and Facebook. I am having problems displaying code in my blog posts so for this post I’m just going to refer you to the FC getting started guide for the actual code to use. If any of you have any recommendations for tools to use to display code in WordPress blog posts I would love to hear them.

Step 1 – First the CCC File

The first thing we want to do is create something called the cross-domain channel communication (CCC) file. That’s an awfully big name for such a little file. Basically this file provides the Facebook JavaScript Client Library with what it needs in order to function properly.

Copy the code from the FC getting started guide located under #2 and paste it into a new file named xd_receiver.htm. This file needs to be placed in a directory that’s relative to the callback URL that you entered when setting up your application in the mega-form above. For those of you following along using CodeIgniter, you should be able to get away with placing this file in the root of your CI application. That’s where everything is really referenced from anyway regardless of the search engine friendly URLs.

Step 2 – Now the Test File

Now that we have the CCC file we can begin writing the file we are going to use to establish our connection. Since we are only testing things in this post we will just make a simple file that displays the Facebook log-in button and adds the application to the users approved applications list. Go ahead and create a new file named test.htm and then follow along with the getting started guide starting with #3 for the necessary markup. Again, for those CI users you can place this markup in a view file and load it using whatever template your program is using.

Before running the script you want to be sure to replace YOUR_API_KEY_HERE with your API key and <path from web root> with the appropriate path to the CCC file. Once you have done that you can upload the two files we’ve created and test.

That’s it!

When viewing your test file in a browser all you should see is a Connect button displayed. When you click the button you should see a pop-up window prompting you to either login to your Facebook account or give your application permission to access your profile like in the screen shot below:

Once you either login or give your application permission you can now go back to your Facebook account and look at the list of your authorized applications and you should now see your own application in the list.

What’s next?

We didn’t get into much of the real nitty gritty in this post but we did lay the ground work for what is to come. In the next post I will begin looking at how we can access information about our users from Facebook and how we can send data back. Stay tuned!

Related posts:

1. Implementing Facebook Connect (Part 3) – Accessing Data from Facebook
2. Implementing Facebook Connect (Part 1) – What is Facebook Connect?
3. Facebook Connect Library for CodeIgniter

I have been spending some time recently developing an online community which will hopefully be launched next quarter. One of the things I wanted to integrate is OpenID to try and lessen the burden of signing-up and logging-in. However, after doing some research I’m thinking that Facebook Connect might be the better way to go. This is the first of at least 2 posts about implementing Facebook Connect with your own PHP application. To begin we will first look at what Facebook Connect is and does and the next post will get technical and look at how to integrate it with your next CodeIgniter or PHP application.

What is Facebook Connect and how does it differ from OpenID?

Facebook Connect (FC) allows users with Facebook accounts to log into your website/service using their Facebook log-in credentials. OpenID provides the same functionality except instead of using your Facebook credentials you use your OpenID credentials. The difference between the two is that FC brings a lot more, in terms of features and functionality, to the table for developers to work with than OpenID does. FC allows users to take their web based social identity with them from site to site.

The Facebook Developers site has a lot of useful information on FC and what you can do with it. Using FC, you can enable “…your users to seamlessly “connect” their Facebook account and information with your site, connect and find their friends who also use your site and share information and actions on your site with their friends on Facebook.” In a nutshell, when you integrate FC with your website or web based application you are allowing your users to interact with their Facebook account from within your app thereby adding value to your site right off the bat.

As I stated above, FC offers more than just authentication. If a user logs into your application using FC you have the ability to interact with that users Facebook profile, friends, Facebook Feed, requests and notifications (if they give your app permission). A nice example of FC functionality and features is a sample app Facebook staff developed as an example called The Run Around. This example shows how FC would be integrated with a typical web app. You can either create your account using The Run Around registration form and connect your Facebook account later on the settings screen. Or, you can just use your Facebook account to log-in and forgo the static registration all together.

When a user logs into The Run Around, and they have connected their account to their Facebook account, the app can now post updates to the users Facebook Feed and show them any friends of theirs that are also using the app. So now you can not only leverage a users Facebook log-in information but you can create an app that interacts with that users Facebook account which I think is totally cool. This opens the door for developers to create nice sites that compliment Facebook and vice verse.

Now that we have covered what Facebook Connect is the next post in this series will begin to look at how we go about using it in our own apps. Check out part 2 to estalibsh your applications connection to Facebook.

Related posts:

1. Implementing Facebook Connect (Part 3) – Accessing Data from Facebook
2. Implementing Facebook Connect (Part 2) – Establishing a Connection
3. Facebook Connect Library for CodeIgniter

When I was developing my first web app (version 1 of BadgeTracker) I really wanted to implement this feature, but for the life of me I couldn’t figure out how to do it. I didn’t even really know what it was called so I had a hell of a time searching for information. I then built Sign-Up-Sheet.com and still had no idea how to accomplish the effect, but I really needed to because each sign-up-sheet needed to have it’s own address and a dynamic address would have been perfect. I don’t really recall how I finally figured out what I was looking for, but the answer to my prayers was Wildcard DNS. In this post I will walk you through implementing Wildcard DNS with your next web app.

Disclaimer

Before I get started I just wanted to mention that I do not claim to be a networking person. I don’t enjoy networking or server administration or anything like that… I’m software not hardware . However, this was a topic that I personally struggled with when starting out and I wanted to pass along what I have found and done.

What is wildcard DNS?

Wildcard DNS is typically defined as: an address record you can place in the DNS for your domain that will send all subdomains (not otherwise declared in your DNS) to a specified IP address. The concept is simple once you figure it out. Adding a Wildcard DNS record to your existing host records looks something like this:

*.christophermonnat.com A 10.5.128.1

The astrisk in this case is the wildcard character. This A record directs all subdomain requests to the IP 10.5.128.1. So now all you have to do is place you web app at the same IP address and you will be well on your way.

Do I need a dedicated IP?

It depends on how your app works. With Sign-Up-Sheet I have one CodeIgniter installation running 2 parts of the site. There is the website/admin area where users can browse the features of the program or sign-in to administer their account. And there is the actual public sign-up-sheet’s themselves which need to be displayed when a user enters the specified sheets address into the browser window. Because my app has 2 parts but is using the same CI installation I decided to use a shared IP for Sign-Up-Sheet.

With BadgeTracker there is only one CI installation but it has nothing to do with the website. The website and application are 2 physically separate things so the easiest way to facilitate this architecture was to get a dedicated IP for the application and leave the website with a shared IP. All subdomains go to the dedicated IP while the WWW record points to the shared.

When asking yourself this question I guess the determining factor boils down to how many parts there are to your app and whether they all belong to a single CI installation or many separate ones.

Wildcard DNS and CI

As I mentioned above, with Sign-Up-Sheet I have one CI install that handles both the display of sign-up-sheets decided by the URL and the front-end website/admin area. Since I’m using a shared IP I chose to have CI handle the determination of what to display to the user and when.

When doing something like this, there are 2 files you need to be concerned with: config/config.php and config/routes.php. In config.php, the issue is the base_url variable. This needs to be set to the home of your app in order for CI to operate properly. The problem with our implementation however is that it may change depending on what the user is requesting. Sometimes it will be a subdomain and other times it will be straight WWW. One way to account for this is to generate the base_url setting dynamically.

[code]
$config['base_url'] = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on") ? "https" : "http");
$config['base_url'] .= "://".$_SERVER['HTTP_HOST'];
$config['base_url'] .= str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
[/code]

The above example is from the CI Wiki. By placing this code in your config.php file, the base_url will be dynamically generated based on what is being requested thereby solving that problem. The other file we need to be concerned with is routes.php. The issue here is that we want to serve the user with a different default controller if they are visiting the site using a subdomain vs. just WWW. We can accomplish this with the following code:

[code]
if(preg_match("/^([a-zA-Z0-9\-_]+)\.([a-zA-Z0-9\-_]+)\.([a-zA-Z]{2,5})$/",$_SERVER["SERVER_NAME"],$matches))
{
list($subdomain,$domain,$tld) = $matches;
}

if($domain == 'www'):
$route['default_controller'] = "main";
else:
$route['default_controller'] = "signup";
endif;
[/code]

The above code looks at the URL and gets just the subdomain portion. We then look at the subdomain and determine if its WWW or something else. From there we decide which default controller to set for the application. Once placed in your routes.php file this accomplishes our goal nicely. Now that we are pointing our users to the correct controller we can refer to our database to find the records associated with the requested subdomain and proceed from there.

Conclusion

Wildcard DNS is available with most popular DNS providers like Enom, Inc. and GoDaddy and is also available with popular control panels like Plesk. If your not sure if your provider offers Wildcard DNS you should ask because there are some out there that don’t. Something I did want to mention about using Wildcard DNS is that it’s not necessarily the answer to all of your problems and should be implemented after careful consideration. The makers of Wufoo, a popular app that makes hosted web forms, wrote a post a while ago about the issues they experienced while working with this kind of setup. It’s a must read before adopting this concept for your own apps.

Well, there you have it Wildcard DNS demystified. If you have any questions or if you are a networking/DNS genius and you see something I have gotten terribly wrong please post a comment and let me know.

Related posts:

1. How-to Ensure a Secure Connection Using PHP

SPAM… a nasty little four letter word. Could mean tasty meat in a can or could mean junk e-mails and form submissions clogging your server and taking up space in your inbox. We are all familiar with it and are engaged in a constant battle to stop it. In this tutorial I’m going to show you how to implement a popular 3rd party CAPTCHA service with your CodeIgniter application.

The commonly accepted approach of handling form SPAM is by using a CAPTCHA control on your forms. The good news is that CodeIgniter comes with it’s own built in CAPTCHA functionality included in the form of a plug-in. I’ve used their plug-in before and it works well. It takes a little bit to get it setup and working properly and requires it’s own database table but it gets the job done.

There is, however, another CAPTCHA tool which I have been using a lot lately called reCAPTCHA and I like it better. reCAPTCHA is a free hosted CAPTCHA service provided by Carnegie Mellon University and serving over 60 million CAPTCHAs a day. This service allows you to integrate a CAPTCHA control on your site quickly and easily without any database modifications or a lot of coding. Below are step-by-step instructions for integrating reCAPTCHA in your CI app.

Step 1 – Create a reCAPTCHA account

Before you can start working with reCAPTCHA you will first need to visit their website and create an account. Once you have filled out the form you will be logged in and prompted to enter your first site. Each site you wish to protect with reCAPTCHA needs to be entered in your account. This is because each site will get it’s own unique private and public keys which you will need to interact with the reCAPTCHA API. So, enter your domain name and click Create Key.

Once you have entered your domain you will now be presented with your public and private key. Take a minute to copy and paste those two long strings into a text document for later use. Be sure to keep track of which is which or else things won’t work properly.

Step 2 – Download the reCAPTCHA PHP library

Now that you have your keys, you will want to download the PHP library they provide for interacting with the reCAPTCHA API. The archive you download will contain two example files and a code file called recaptchalib.php. Once you have the archive, unzip it and move the recaptchalib.php file into your applications helpers folder.

Why a helper and not a library?

We could certainly turn what they provided us into a library, but that would involve changing some of the code they provided since they are not providing a class. The recaptchalib.php contains a number of functions which are meant to help while interacting with the API. Therefore, it fits the helper definition nicely.

Step 3 – Use the library in your project

Now that we have the code we can use it in our application. The first thing we need to do is display the CAPTCHA control on the form your trying to protect. So, first load the helper:

$this->load->helper('recaptchalib');

Now that we have access to the helper functions, we can use the recaptcha_get_html() function.

<?php echo recaptcha_get_html($public_key); ?>

You will want to place this function in your view where you want to display the form control. This function takes only one argument: the public key you received earlier when you added your site to your reCAPTCHA account. You can either add both the public and private keys as class variables to your current controller. Or, my preference is to add the public and private keys to a custom config file that I autoload throughout my entire app. That way I can use the control anyplace in my site without duplicating my keys.

Now that we have the control displaying on our form we need to add code to handle the validation.

<?php

// Validate the captcha submission.
function val_recaptcha($string)
{
	$resp = recaptcha_check_answer($this->config->item('recap_private'),
									$_SERVER["REMOTE_ADDR"],
									$this->input->post("recaptcha_challenge_field"),
									$this->input->post("recaptcha_response_field"));

	if(!$resp->is_valid) {
		$this->validation->set_message('val_recaptcha','Your answer for the security question was incorrect, please try again.');
		return FALSE;
	}
	else {
		return TRUE;
	}
}

function process_form()
{
	$this->load->library('validation');
	$this->load->helper('recaptcha_helper');

	$this->validation->set_error_delimiters('<li>', '</li>');

	// Validation rules.
	$rules['recaptcha_challenge_field'] = 'required|callback_val_recaptcha';
	$this->validation->set_rules($rules);

	// Validation field names (for display in error messages).
	$fields['recaptcha_challenge_field'] = 'Security Question';
	$this->validation->set_fields($fields);

	if($this->validation->run() == FALSE) {
		// display errors
	}
	else {
		// process submission
	}
}

?>

In the above code we are using CI’s built in validation library to validate the CAPTCHA. You can of course add any additional rules or fields that are needed. I’ve created a custom validation function called val_recaptcha() which is called via a callback within the validation rules on the recaptcha_challenge_field field (which is created when we used the recaptcha_get_html() function above). This validation function uses the recaptcha_check_answer() function from the reCAPTCHA helper to check whether what the user submitted is correct or not.

And that’s really all there is to it. You are now using the same CAPTCHA protection as Facebook and many other sites throughout the web.

Wait… it’s RED! Can I make it look better?

Absolutely, the reCAPTCHA website has detailed instructions for how to alter the look and feel of the reCAPTCHA form control. There are a number of pre-set themes which you can choose from or you can create your own.

Related posts:

1. Generating PDF files using CodeIgniter
2. How-to Ensure a Secure Connection Using PHP
3. Building Applications using CodeIgniter (Part 3) – Helpers

When generating reports in PDF format you suddenly have a lot more control over layout and design than  you do with plain old HTML and CSS (although much progress is being made with print style sheets). You can create some really nice reports on the fly that your users can view, save for later or e-mail to their co-workers for review. In this post I will show you how I generate PDF reports using CodeIgniter.

Quick Note

There are a number of PHP libraries out there for generating PDF files (like FPDF, Panda and dompdf) but the best one I have come across is the R&OS pdf class. I was first introduced to it from the PHP Anthology first edition by Harry Fuecks. I have tried other PDF libraries (some PHP 5 specific and some not) and none of them have been able to provide me with the same control or ease of use that the R&OS class has which is why I’m using it for this tutorial.

Getting Started

Before we start, lets get everyone to the same place so you can follow along as we go. I’ve prepared a .zip file containing everything you’ll need to follow along. The archive includes CI 1.6.3 along with all the code and libraries we will discuss in this tutorial. Simply download the archive, unzip it on your web server and follow along.

I have done all the work of downloading the code library and putting the files in their right place for you, but I wanted to mention where things were for the detail oriented among you. There are 2 files that are necessary in order to use the R&OS library: class.ezpdf.php and class.pdf.php. Those two files have been placed in the application/library folder. R&OS also requires some font files in order to function and they have been placed at the root of the .zip file in a folder called fonts.

You do have to make a minor modification to the class.ezpdf.php file so that it will work properly within CI. First I renamed the file to cezpdf.php, which makes it easier to load using the CI loader. Then you have to modify the include statement on line 3 to:

include_once(APPPATH . 'libraries/class.pdf.php');

This will keep PHP from saying that it can’t find included file. Once those modifications are made the R&OS class is ready to use with CI.

In the archive, I have also made a controller called tutorial.php and a helper called pdf_helper.php both in their respective directories. With the background info. out of the way, lets get our hands dirty with a real simple example.

Hello World

function hello_world()
{
$this->load->library('cezpdf');

$this->cezpdf->ezText('Hello World', 12, array('justification' => 'center'));
$this->cezpdf->ezSetDy(-10);

$content = 'The quick, brown fox jumps over a lazy dog. DJs flock by when MTV ax quiz prog.
Junk MTV quiz graced by fox whelps. Bawds jog, flick quartz, vex nymphs.';

$this->cezpdf->ezText($content, 10);

$this->cezpdf->ezStream();
}

The above code produces a PDF file like this.

In the above, first thing we do is load the R&OS library for use. Next we use the ezText() function to create a title for our document. This function takes the text it will display as the first argument, the size of that text and an optional array of additional configuration options. In this instance we pass along a justification option of center. That will center our title at the top of our document.

After the title we insert some extra white space using the ezSetDy() function. After the whites pace we put the rest of the content for the document in a variable called $content and add it to our document using the ezText() function again. Finally, we create our document using the ezStream() function which actually creates the document and sends it to the users which prompts them to view/download the generated PDF document.

Handling Tabular Data

When your dealing with business reports the odds are good that you will need to generate reports with tables to display tabular data. From my experience with other PDF libraries, this is not an easy task. But with the R&OS library it’s about as hard as creating an array.

function tables()
{
$this->load->library('cezpdf');

$db_data[] = array('name' => 'Jon Doe', 'phone' => '111-222-3333', 'email' => 'jdoe@someplace.com');
$db_data[] = array('name' => 'Jane Doe', 'phone' => '222-333-4444', 'email' => 'jane.doe@something.com');
$db_data[] = array('name' => 'Jon Smith', 'phone' => '333-444-5555', 'email' => 'jsmith@someplacepsecial.com');

$col_names = array(
'name' => 'Name',
'phone' => 'Phone Number',
'email' => 'E-mail Address'
);

$this->cezpdf->ezTable($table_data, $col_names, 'Contact List', array('width'=>550));
$this->cezpdf->ezStream();
}

The above code should produce a PDF file like this.

In the above code I create an array of data called $db_data. I put this together so that it imitates a typical database result set because that’s usually where you will be getting your data from. Below my data array I have created a $col_names array that associates the data elements in the $db_data array with a column title for the table. This is where the R&OS gets the title to display at the top of each table column. Once I have the data and column titles I create the table by calling the ezTable() function. This function takes the data array, an associative array for column names, the title for the table and an optional array of configuration options. There are a number of options that can be configured through that last optional array, but I’m not going to go into them in this tutorial.

Headers and Footers

Most reports in a corporate setting come with some kind of standard header and/or footer. They can include anything from the date/time generated, the user who generated them, to page numbers and the like. Headers and footers are handy to have, but unfortunately there isn’t a real good way to add them to printable reports generated in HTML and CSS. There’s one more reason to use the portable document format when creating printable reports.

The process of adding headers and footers to a PDF using the R&OS library is the slightest bit complicated. There are a lot of lines of code just to accomplish it, that’s why I have created a helper file. Since the code is in a helper function, you just need load the helper and call the function whenever you need to add headers/footers to a PDF.

function prep_pdf($orientation = 'portrait')
{
$CI = & get_instance();

$CI->cezpdf->selectFont(base_url() . '/fonts');

$all = $CI->cezpdf->openObject();
$CI->cezpdf->saveState();
$CI->cezpdf->setStrokeColor(0,0,0,1);
if($orientation == 'portrait') {
$CI->cezpdf->ezSetMargins(50,70,50,50);
$CI->cezpdf->ezStartPageNumbers(500,28,8,'','{PAGENUM}',1);
$CI->cezpdf->line(20,40,578,40);
$CI->cezpdf->addText(50,32,8,'Printed on ' . date('m/d/Y h:i:s a'));
$CI->cezpdf->addText(50,22,8,'CI PDF Tutorial - http://www.christophermonnat.com');
}
else {
$CI->cezpdf->ezStartPageNumbers(750,28,8,'','{PAGENUM}',1);
$CI->cezpdf->line(20,40,800,40);
$CI->cezpdf->addText(50,32,8,'Printed on '.date('m/d/Y h:i:s a'));
$CI->cezpdf->addText(50,22,8,'CI PDF Tutorial - http://www.christophermonnat.com');
}
$CI->cezpdf->restoreState();
$CI->cezpdf->closeObject();
$CI->cezpdf->addObject($all,'all');
}

An example of how I use this helper is provided in the headers() function of the tutorial.php controller. That code produces a PDF file like this.

The above code is the prep_pdf() function located in the pdf_helper.php file. This function does all the hard work of creating a footer for my PDF reports for me. All I have to do is load the helper in my controller and call the function. Since the reports could be portrait or landscape I have also included the ability to pass the orientation to the function and the code will modify the document margins accordingly.

I’m not going to go into a lot of detail about the above code because this tutorial could become very long. But the general idea is that I’m using the R&OS library to modify the margins of the document I’m creating, add page numbers and text to the very bottom of the document. R&OS has some functions that makes this easy like ezStartPageNumbers() and line(). Once all that is done I can add any kind of content to the document back in my controller and then just call ezStream() to generate the final document.

Wrap Up

I barely scratched the surface of what you can do with the R&OS PDF library in this tutorial. I encourage you to spend some quality time with the readme.pdf documentation file that comes with the library when you download it. That file goes over all the functions and their options in great detail.

So there you have it, generating PDF files with CodeIgniter and the R&OS library. If this method doesn’t quite do it for you, there are a few helpful articles on the CodeIgniter wiki, like this one and this one, which walk you through some additional options. Whatever solution you choose I hope this tutorial has helped to introduce you to some of the options you have at your disposale for creating PDF reports with CodeIgniter.

Related posts:

1. Building Applications using CodeIgniter (Part 3) – Helpers
2. Building Applications using CodeIgniter (Part 4) – Code Templates
3. How to use reCAPTCHA with CI