Web Technology II

SOAP (Simple Object Access Protocol) is an XML-based messaging protocol used by web services to exchange structured information between applications over a network, usually over HTTP (also SMTP, TCP). It is platform and language independent and is standardised by W3C.

SOAP message structure (an XML document)

• Envelope: root element that identifies the XML as a SOAP message (required).
• Header: optional; carries extra information such as authentication, transaction id.
• Body: required; contains the actual request or response data.
• Fault: optional element inside the body for error reporting.

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Header/>
  <soap:Body>
    <getPrice><item>Book</item></getPrice>
  </soap:Body>
</soap:Envelope>

Features: works with WSDL (describes the service) and UDDI (registry); supports strict contracts, WS-Security, and ACID-like transactions; can work through firewalls because it uses HTTP.

Advantages: standardised, extensible, secure, language independent. Disadvantages: verbose XML so slower and heavier than REST/JSON, more complex to implement.

Content Management System (CMS): software that allows users to create, edit, organise, publish and maintain digital content (text, images, video, documents) on a website through a simple interface, without programming knowledge. Examples: WordPress, Joomla, Drupal.

How a CMS helps to manage content

• Content creation and editing: a WYSIWYG editor lets authors add and format pages and posts.
• Central repository: content is stored in a database and media in a library, so it is easy to search and reuse.
• Separation of content and design: templates and themes control the layout, so changing the design does not affect the content.
• User roles and permissions: administrator, editor and author roles with approval workflow.
• Version control: keeps revisions so old versions can be restored.
• Scheduling and publishing: posts can be drafted and published automatically at a set time.
• Categorisation and navigation: categories, tags and menus organise content; search support.
• Plugins/extensions add features such as SEO, forms and e-commerce.

Advantages of CMS

• No technical skill needed for updating a website.
• Saves time and development cost.
• Multiple users can collaborate.
• Consistent design across all pages.
• SEO friendly and supports multiple languages.
• Easy to extend with plugins and themes; scalable.
• Regular updates and security patches and community support (open source).
• Content can be updated from anywhere through a web browser.
• Better control of access and content approval.

GET and POST are the two most common HTTP request methods for sending form data to a server.

GET

• Data is appended to the URL as a query string: page.php?name=Ram&age=20.
• Visible in the address bar, browser history and server logs, so it is not secure for passwords.
• Limited length (about 2000 characters), only ASCII text.
• Can be bookmarked and cached; it is idempotent.
• Used to retrieve data, search forms, links. PHP: $_GET; Servlet: doGet().

POST

• Data is sent in the body of the HTTP request, not shown in the URL.
• More secure for sensitive data (though still needs HTTPS), no practical size limit, supports binary data and file upload.
• Not cached or bookmarked; re-submitting prompts a warning.
• Used to create or update data: login, registration, file upload. PHP: $_POST; Servlet: doPost().

<form action="process.php" method="post">

The mail() function is PHP's built-in function for sending email directly from a script.

Syntax

mail($to, $subject, $message, $additional_headers, $additional_parameters);

• $to: recipient address(es), comma separated.
• $subject: subject line.
• $message: body text; lines should be separated by \n and not exceed 70 characters.
• $additional_headers (optional): From, Cc, Bcc, Content-type, separated by \r\n.
• $additional_parameters (optional): extra options to the mail program.

It returns true if the mail was accepted for delivery, otherwise false.

Example

<?php
$headers = "From: admin@example.com\r\n" .
           "Content-type: text/html; charset=UTF-8\r\n";
if (mail("user@example.com", "Test", "<b>Hello</b>", $headers)) {
    echo "Mail sent";
} else {
    echo "Mail not sent";
}
?>

Requirements: a mail server must be configured in php.ini (SMTP, smtp_port, sendmail_from on Windows; sendmail_path on Linux).

Limitations: no SMTP authentication, difficult attachments, may be flagged as spam, and user input in headers must be sanitised to avoid header injection. Libraries like PHPMailer are preferred for production.

Server

A server is a computer system or program that provides services, resources or data to other computers (clients) over a network. Examples are web servers (Apache, Nginx), database servers, file servers, mail servers and application servers. A server listens for client requests, processes them and sends back responses.

Monolithic vs microservices architecture

A monolithic application is built as a single deployable unit containing the UI, business logic and data access. A microservices application is a set of small, independent services, each handling one business function, communicating through APIs (HTTP/REST, messaging).

Monolithic suits small projects and small teams; microservices suit large, rapidly changing systems needing independent scaling.

# ---------- LIST (mutable, ordered) ----------
fruits = ["apple", "banana", "cherry"]
fruits.append("mango")          # 1. add at end
fruits.insert(1, "orange")      # 2. insert at index
fruits.remove("banana")         # 3. remove by value
fruits.sort()                   # 4. sort
print("List:", fruits)
print("First:", fruits[0], "Length:", len(fruits))

# ---------- TUPLE (immutable, ordered) ----------
point = (10, 20, 30, 20)
print("\nTuple:", point)
print("Index 1:", point[1])            # 1. indexing
print("Count of 20:", point.count(20)) # 2. count
print("Index of 30:", point.index(30)) # 3. index
x, y, z, w = point                     # 4. unpacking
print("Unpacked:", x, y, z, w)
bigger = point + (40,)                 # 5. concatenation (new tuple)
print("Concatenated:", bigger)

# ---------- DICTIONARY (key-value, mutable) ----------
student = {"name": "Sita", "age": 20, "course": "BCA"}
student["age"] = 21                    # 1. update value
student["address"] = "Kathmandu"       # 2. add new key
removed = student.pop("course")        # 3. remove key
print("\nDictionary:", student)
print("Removed:", removed)
for key, value in student.items():     # 4. iterate
    print(key, "->", value)
print("Keys:", list(student.keys()))
print("Values:", list(student.values()))

Output (summary): the list is sorted as ['apple', 'cherry', 'mango', 'orange']; the tuple operations give index 20, count 2, index 30 is 2, and the concatenated tuple (10, 20, 30, 20, 40); the dictionary becomes {'name': 'Sita', 'age': 21, 'address': 'Kathmandu'}.

Lists are changeable, tuples cannot be changed after creation, and dictionaries store data as key-value pairs.

Function in Python

A function is a named, reusable block of code that performs a specific task. It is defined with the def keyword, may take parameters, and may return a value with return. Functions reduce repetition and make a program modular and easy to test.

def calculate_bill(units):
    if units <= 100:
        bill = units * 5
    elif units <= 200:
        bill = 100 * 5 + (units - 100) * 7
    else:
        bill = 100 * 5 + 100 * 7 + (units - 200) * 10
    return bill

def main():
    units = int(input("Enter units consumed: "))
    if units < 0:
        print("Units cannot be negative")
        return
    print("Total bill = Rs", calculate_bill(units))

main()

Sample runs:

• 80 units: $80 \times 5 =$ Rs 400
• 150 units: $500 + 50 \times 7 =$ Rs 850
• 250 units: $500 + 700 + 50 \times 10 =$ Rs 1700

import csv

students = []
for i in range(1, 11):
    print(f"Enter details of student {i}")
    name = input("Name: ")
    address = input("Address: ")
    mobile = input("Mobile number: ")
    age = int(input("Age: "))
    students.append([name, address, mobile, age])

with open("students.csv", "w", newline="") as f:
    writer = csv.writer(f)
    writer.writerow(["Name", "Address", "Mobile", "Age"])  # header
    writer.writerows(students)

print("Details of 10 students written to students.csv")

The csv module's writer converts each list to a comma-separated line; newline="" avoids blank lines on Windows, and the with statement closes the file automatically.

Framework

A framework is a ready-made collection of libraries, tools and conventions that provides a standard structure for building applications, so that developers do not write common functionality from scratch. Examples: Flask, Django (Python), Laravel (PHP), Spring (Java).

Importance for developing a secure application

• Built-in protection against common attacks: CSRF tokens, XSS auto-escaping of templates, SQL injection prevention through ORM and parameterised queries.
• Tested, widely reviewed code is more reliable than self-written security code, and security patches are released regularly.
• Standard implementations of authentication, session management, password hashing and input validation.
• Enforces consistent structure and coding practices, which reduces mistakes.
• Faster development leaves more time for security testing; community support and documentation.

Why Flask is called a micro framework

Flask is called "micro" because its core is small and simple: it only provides routing, request/response handling (Werkzeug) and templating (Jinja2). It does not force a particular database, ORM, form validation or authentication layer. These are added as extensions as needed (Flask-SQLAlchemy, Flask-WTF, Flask-Login, Flask-Mail). It does not mean Flask is limited or only for small apps; it keeps the core light and gives the developer freedom, in contrast to "batteries included" frameworks such as Django.

from flask import Flask
app = Flask(__name__)

@app.route("/")
def home():
    return "Hello, Flask!"

Database

A database is an organised collection of related data stored electronically so that it can be easily accessed, managed and updated, usually through a DBMS such as MySQL, PostgreSQL or SQLite.

Why SQLAlchemy is used with Flask

SQLAlchemy is a Python SQL toolkit and Object Relational Mapper. With Flask (via Flask-SQLAlchemy):

• Tables are written as Python classes and rows as objects, so no raw SQL is needed for most work.
• The same code works with different databases (SQLite, MySQL, PostgreSQL) by changing the connection URI.
• Queries are parameterised, which protects from SQL injection.
• It manages sessions, connection pooling and transactions, and integrates with Flask's configuration and migration tools (Flask-Migrate).

ORM vs Core

ORM is built on top of Core, and both can be used together in one application.

Sessions vs cookies

Sending email in Flask (Flask-Mail)

from flask import Flask
from flask_mail import Mail, Message

app = Flask(__name__)
app.config['MAIL_SERVER'] = 'smtp.gmail.com'
app.config['MAIL_PORT'] = 587
app.config['MAIL_USE_TLS'] = True
app.config['MAIL_USERNAME'] = 'your_email@gmail.com'
app.config['MAIL_PASSWORD'] = 'your_app_password'
app.config['MAIL_DEFAULT_SENDER'] = 'your_email@gmail.com'

mail = Mail(app)

@app.route("/send")
def send_mail():
    msg = Message(subject="Hello from Flask",
                  recipients=["receiver@example.com"])
    msg.body = "This is a test email sent from a Flask application."
    mail.send(msg)
    return "Email sent successfully"

if __name__ == "__main__":
    app.run(debug=True)

Install with pip install Flask-Mail. The SMTP server settings are configured, a Message is created with subject, recipient and body, and mail.send() delivers it. Credentials should be kept in environment variables, not in the code.

Content Management System (CMS)

A CMS is software that lets users create, edit, organise, publish and manage digital content (usually a website) without needing to write code, by separating content from design and presentation.

Features

• Easy content editor (WYSIWYG) and media library
• Templates/themes for design
• User roles and permissions
• Plugins/extensions for added functions
• SEO tools, menus and URL management
• Version control and content scheduling
• Multi-user workflow and approval
• Security updates, backups, multi-language support

Advantages

• No programming knowledge needed to maintain a site
• Quick and low-cost development
• Many people can work together with controlled access
• Consistent look across the site
• Easy to extend and redesign
• Strong community support and regular updates
• Content can be updated from anywhere through a browser

Popular CMS

WordPress, Joomla, Drupal, Wix, Shopify (e-commerce), Magento, Ghost, and Squarespace.

app.py

from flask import Flask, render_template
from flask_sqlalchemy import SQLAlchemy

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///school.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
db = SQLAlchemy(app)

class Student(db.Model):
    __tablename__ = 'students'
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(100), nullable=False)
    address = db.Column(db.String(100))
    age = db.Column(db.Integer)

@app.route('/')
def show_students():
    students = Student.query.all()
    return render_template('students.html', students=students)

if __name__ == '__main__':
    with app.app_context():
        db.create_all()
    app.run(debug=True)

templates/students.html

<!DOCTYPE html>
<html>
<head>
  <title>Students</title>
  <style>
    table { border-collapse: collapse; width: 60%; }
    th, td { border: 1px solid #333; padding: 6px; text-align: left; }
    th { background: #eee; }
  </style>
</head>
<body>
  <h2>Student List</h2>
  <table>
    <tr><th>ID</th><th>Name</th><th>Address</th><th>Age</th></tr>
    {% for s in students %}
    <tr>
      <td>{{ s.id }}</td>
      <td>{{ s.name }}</td>
      <td>{{ s.address }}</td>
      <td>{{ s.age }}</td>
    </tr>
    {% endfor %}
  </table>
</body>
</html>

The model maps the students table; Student.query.all() fetches all records, which are passed to the Jinja2 template and shown row by row in an HTML table.

SQLAlchemy

SQLAlchemy is a Python SQL toolkit and Object Relational Mapper (ORM) that lets developers work with relational databases using Python classes and objects instead of writing raw SQL.

Role in Flask applications

• Provides the database layer: models are classes, tables are created from them.
• Hides database differences; the same code runs on SQLite, MySQL or PostgreSQL by changing the URI.
• Performs insert, query, update and delete through simple methods and session handling.
• Protects against SQL injection by using parameterised queries.
• Manages connection pooling and transactions.
• Works with Flask-Migrate for schema migrations.

Sample code: configure and connect

from flask import Flask
from flask_sqlalchemy import SQLAlchemy

app = Flask(__name__)

# database URI: dialect://user:password@host/dbname
app.config['SQLALCHEMY_DATABASE_URI'] = 'mysql+pymysql://root:password@localhost/mydb'
# for SQLite: 'sqlite:///mydb.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False

db = SQLAlchemy(app)

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)

with app.app_context():
    db.create_all()                     # create tables
    db.session.add(User(username="ram", email="ram@example.com"))
    db.session.commit()                 # save
    print(User.query.all())

if __name__ == "__main__":
    app.run(debug=True)

The URI in app.config tells Flask-SQLAlchemy which database to connect to; db.create_all() creates the tables defined by the models, and the session is used to add and commit records.

SOAP protocol

SOAP (Simple Object Access Protocol) is an XML-based messaging protocol for exchanging structured information between web services, usually over HTTP or SMTP. A SOAP message has an Envelope, an optional Header, a Body, and optional Fault. It is described with WSDL, is platform and language independent, supports WS-Security, and is strict and heavier than REST.

HTTP methods in RESTful APIs

REST uses standard HTTP methods on resources identified by URLs:

Responses carry status codes such as 200 OK, 201 Created, 400 Bad Request, 404 Not Found and 500 Server Error, and data is typically JSON.

Development vs production environment

Why not to run development servers in production

• They are designed for convenience, not performance: they handle few concurrent requests, are single-threaded or poorly scaled.
• Debug mode shows stack traces and can allow an interactive debugger, which lets attackers execute code and reveal secrets.
• They lack security hardening, HTTPS handling, and proper logging and monitoring.
• They are not stable or reliable under heavy traffic, and can crash or hang.
• Auto-reloaders and debug features consume resources.

Production should use a production WSGI server such as Gunicorn with a reverse proxy, with DEBUG = False.

Threat, vulnerability and attack

• Threat: a potential danger or circumstance that could harm a system or data, e.g. a hacker, malware, or a natural disaster. It has not necessarily happened.
• Vulnerability: a weakness in design, code, configuration or procedure that can be exploited, e.g. unpatched software, weak passwords, unvalidated input.
• Attack: an actual attempt to exploit a vulnerability to damage, steal or gain unauthorised access, e.g. phishing, DDoS, SQL injection.

Relation: a threat uses a vulnerability to carry out an attack. Risk is the likelihood and impact of this.

Injection

Injection is an attack in which untrusted input is sent to an interpreter as part of a command or query, and tricks it into executing unintended commands. Types: SQL, command (OS), LDAP, NoSQL and XSS/HTML injection.

Example of SQL injection: the query SELECT * FROM users WHERE name='$u' AND pass='$p' with input ' OR '1'='1 becomes always true and bypasses login.

Protection against injection

• Use parameterised queries / prepared statements, or an ORM.
• Validate and sanitise all input (whitelisting) and escape output.
• Use least-privilege database accounts.
• Avoid building commands by string concatenation.
• Hide detailed error messages, use a web application firewall, and keep software updated.
• Perform regular security testing.

Web application security

Web application security is the practice of protecting websites and web applications, their data and users from attacks and unauthorised access. It covers confidentiality, integrity and availability, and defends against threats such as SQL injection, XSS, CSRF, broken authentication and session hijacking, using input validation, HTTPS, secure authentication, access control, patching and logging.

Necessity of Role Based Access Control (RBAC)

In RBAC, permissions are assigned to roles (admin, teacher, student) and users are assigned roles, not individual permissions. It is necessary because:

• It enforces the principle of least privilege: users get only the access needed.
• Easier administration: changing a role updates all users in it; adding or removing users is easy.
• Reduces the risk of data leaks and insider misuse.
• Separation of duties and clear accountability.
• Helps meet audit and compliance requirements.
• Scales well as the number of users grows.

Authentication vs authorization

SSL/TLS

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that secure communication over a network. They sit between the application and transport (TCP) layers and are the basis of HTTPS. SSL is now obsolete; TLS 1.2 and 1.3 are in use.

Services provided

• Confidentiality: data is encrypted (symmetric encryption such as AES).
• Integrity: message authentication codes detect tampering.
• Authentication: server (and optionally client) is verified with digital certificates issued by a Certificate Authority.

Working (handshake):

1. Client sends "hello" with supported versions and cipher suites.
2. Server responds with its chosen cipher suite and its certificate (public key).
3. Client verifies the certificate.
4. Client and server exchange keys (e.g. ECDHE) and derive a shared session key.
5. Both use the session key for encrypted communication.

Used in HTTPS, email (SMTPS, IMAPS), FTPS and VPNs.

MVC architecture

Model-View-Controller is a design pattern that divides an application into three connected components, separating data, presentation and logic.

• Model: manages data and business rules; communicates with the database (e.g. SQLAlchemy models).
• View: the user interface that displays data to the user (HTML templates).
• Controller: receives user input, calls the model, selects the view and returns the response (Flask route functions).

Flow: the user sends a request to the controller, the controller asks the model for or updates the data, and the view renders the result which is sent back to the user.

Advantages: separation of concerns, easier maintenance and testing, parallel development by different teams, reuse of components, and multiple views for the same model.

Frameworks using MVC (or MVT) include Laravel, Spring MVC, ASP.NET MVC, Ruby on Rails and Django.

CSV

CSV (Comma-Separated Values) is a plain-text format for tabular data in which each line is a record and values are separated by commas, with an optional header row. It is simple, compact and opens in spreadsheets, but has no data types or nesting.

name,age,city
Ram,20,Kathmandu
Sita,21,Pokhara

JSON

JSON (JavaScript Object Notation) is a lightweight text format for structured data using key-value pairs and arrays. It supports nesting, strings, numbers, booleans and null, is easy for humans to read and for machines to parse, and is the common format for web APIs.

{"name": "Ram", "age": 20, "courses": ["BCA", "Python"]}

Comparison: CSV is best for flat tables and is smaller; JSON handles hierarchical data and is better for APIs. In Python, the csv and json modules read and write them (csv.reader, json.loads, json.dumps).

Web server

A web server is software (and the computer running it) that stores web content and delivers it to clients, usually browsers, using HTTP/HTTPS. It receives requests, finds the resource or runs a script, and returns a response. Examples: Apache, Nginx, Microsoft IIS.

How HTTPS ensures secure communication

HTTPS is HTTP over SSL/TLS. It gives:

• Encryption: after a TLS handshake the client and server agree on a session key, so data cannot be read by eavesdroppers.
• Authentication: the server presents a digital certificate signed by a trusted CA, so the client knows it is talking to the real site.
• Integrity: message authentication codes detect any change of data in transit.

The handshake: client hello, server hello with certificate, certificate verification, key exchange, then encrypted data transfer (default port 443).

HTTP request and response mechanism

HTTP is a stateless request-response protocol on top of TCP (port 80).

1. The client opens a connection to the server and sends a request: request line (method, URL, version, e.g. GET /index.html HTTP/1.1), headers (Host, User-Agent, Accept, Cookie), and an optional body (for POST).
2. The server processes the request and sends a response: status line (HTTP/1.1 200 OK), headers (Content-Type, Content-Length, Set-Cookie), and the body (HTML, JSON, image).
3. The browser renders the response; the connection is closed or reused (keep-alive).

Status codes: 2xx success, 3xx redirection, 4xx client error (404), 5xx server error (500).

Array

An array is a variable that can hold many values under a single name, each accessed by an index or key. In PHP arrays are ordered maps and can mix types.

Types: indexed arrays (numeric index), associative arrays (named keys), and multidimensional arrays (arrays of arrays).

Ways of creating an array in PHP

1. Using array() function

$colors = array("red", "green", "blue");

2. Using short square-bracket syntax (PHP 5.4+)

$colors = ["red", "green", "blue"];

3. Assigning elements one by one (index or key)

$fruits[0] = "apple";
$fruits[1] = "mango";
$fruits[] = "banana";      // appended

4. Associative array (key => value)

$student = array("name" => "Ram", "age" => 20, "course" => "BCA");
echo $student["name"];

5. Multidimensional array

$marks = [
    ["Ram", 80, 75],
    ["Sita", 90, 85]
];
echo $marks[1][0];         // Sita

6. Using functions such as range(1, 5) giving 1,2,3,4,5, explode(",", "a,b,c"), and array_fill().

Accessing: echo $colors[1]; prints green; loop with foreach ($student as $key => $value) { echo "$key = $value<br>"; }. Useful functions: count(), array_push(), array_pop(), sort(), in_array().

doctor_form.html

<!DOCTYPE html>
<html>
<head><title>Doctor Registration</title></head>
<body>
  <h2>Add Doctor</h2>
  <form method="post" action="insert_doctor.php">
    Doctor Name: <input type="text" name="doctor_name" required><br><br>
    Specialization: <input type="text" name="specialization" required><br><br>
    Phone Number: <input type="text" name="phone_number" required><br><br>
    Hospital Name: <input type="text" name="hospital_name" required><br><br>
    <input type="submit" value="Save">
  </form>
</body>
</html>

insert_doctor.php

<?php
$conn = new mysqli("localhost", "root", "", "hospitaldb");
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = trim($_POST["doctor_name"]);
    $spec = trim($_POST["specialization"]);
    $phone = trim($_POST["phone_number"]);
    $hospital = trim($_POST["hospital_name"]);
    $errors = [];

    if ($name == "" || !preg_match("/^[A-Za-z .]+$/", $name)) {
        $errors[] = "Enter a valid doctor name.";
    }
    if ($spec == "") {
        $errors[] = "Specialization is required.";
    }
    if (!preg_match("/^[0-9]{10}$/", $phone)) {
        $errors[] = "Phone number must be 10 digits.";
    }
    if ($hospital == "") {
        $errors[] = "Hospital name is required.";
    }

    if (count($errors) > 0) {
        foreach ($errors as $e) {
            echo $e . "<br>";
        }
    } else {
        $stmt = $conn->prepare("INSERT INTO doctors (doctor_name, specialization, phone_number, hospital_name) VALUES (?, ?, ?, ?)");
        $stmt->bind_param("ssss", $name, $spec, $phone, $hospital);
        if ($stmt->execute()) {
            echo "Doctor information saved successfully.";
        } else {
            echo "Error: " . $stmt->error;
        }
        $stmt->close();
    }
}
$conn->close();
?>

Table: CREATE TABLE doctors (id INT AUTO_INCREMENT PRIMARY KEY, doctor_name VARCHAR(100), specialization VARCHAR(100), phone_number VARCHAR(15), hospital_name VARCHAR(100));

The form posts data to the script, which validates every field and inserts the row using a prepared statement, which also prevents SQL injection.

Prepared statements are precompiled SQL templates in which the data values are replaced by placeholders (? or :name). The SQL structure is sent to the database first, and the actual values are sent separately later and bound to the placeholders. PHP supports them through MySQLi and PDO.

Steps

1. Prepare the SQL statement with placeholders.
2. Bind the variables to the placeholders (with their types).
3. Execute the statement.
4. Fetch results / close the statement.

How they prevent SQL injection

In SQL injection the attacker types SQL code (e.g. ' OR '1'='1) into an input field. If the input is concatenated into the query string, the database treats it as part of the command. With a prepared statement the query structure is already parsed and fixed before any data arrives; the bound values are always treated as plain data, never as SQL code. Special characters such as quotes lose their meaning, so the injected text cannot change the query logic.

Vulnerable code (do not use)

$sql = "SELECT * FROM users WHERE username='$u' AND password='$p'";

If $u = admin' -- the password check is commented out.

Safe code using MySQLi

<?php
$conn = new mysqli("localhost", "root", "", "college");
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$username = $_POST['username'];
$password = $_POST['password'];

// 1. prepare
$stmt = $conn->prepare("SELECT id, username FROM users WHERE username = ? AND password = ?");
// 2. bind (s = string)
$stmt->bind_param("ss", $username, $password);
// 3. execute
$stmt->execute();
// 4. fetch
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    $row = $result->fetch_assoc();
    echo "Welcome, " . htmlspecialchars($row['username']);
} else {
    echo "Invalid login";
}
$stmt->close();
$conn->close();
?>

Same example with PDO

$pdo = new PDO("mysql:host=localhost;dbname=college", "root", "");
$stmt = $pdo->prepare("INSERT INTO student (name, email) VALUES (:name, :email)");
$stmt->execute([':name' => $name, ':email' => $email]);

Other advantages: the statement is parsed once and can be executed many times with different values (faster for repeated queries), and the code is cleaner because no manual escaping is needed.

HTTP is a stateless protocol: each request is independent and the server does not remember the previous one. Cookies and sessions are the two mechanisms used to maintain state (e.g. keep a user logged in) between client and server.

Cookies

• A cookie is a small piece of data (up to about 4 KB) that the server sends to the browser, which stores it on the client machine and returns it automatically with every later request to the same site.
• Stored on the client, so the user can view or modify it; not suitable for sensitive data.
• Has an expiry time; can persist after the browser closes.
• Uses: remembering user preferences, "remember me" login, tracking, language/theme.

Sessions

• A session stores data on the server. The browser keeps only a unique session ID (usually in the cookie PHPSESSID) which links it to its data.
• More secure than cookies, can hold more data, and normally ends when the browser closes or after a timeout.
• Uses: login status, shopping cart, user id across pages.

Working together: the server creates a session, sends the ID as a cookie, and on each request reads the ID back and loads the matching server-side data.

PHP program demonstrating cookies

<?php
// set a cookie that lasts 1 hour
if (isset($_POST['name'])) {
    setcookie("username", $_POST['name'], time() + 3600, "/");
    header("Location: " . $_SERVER['PHP_SELF']);   // reload so the cookie is visible
    exit;
}

// delete cookie
if (isset($_GET['logout'])) {
    setcookie("username", "", time() - 3600, "/");
    header("Location: " . $_SERVER['PHP_SELF']);
    exit;
}
?>
<!DOCTYPE html>
<html>
<body>
<?php
if (isset($_COOKIE['username'])) {
    echo "Welcome back, " . htmlspecialchars($_COOKIE['username']) . "!";
    echo " <a href='?logout=1'>Delete cookie</a>";
} else {
    echo "Hello, guest.";
?>
    <form method="post">
        Name: <input type="text" name="name">
        <input type="submit" value="Save">
    </form>
<?php } ?>
</body>
</html>

setcookie() must be called before any HTML output because cookies are sent in HTTP headers. The cookie is read through the $_COOKIE superglobal, and deleted by setting an expiry time in the past.

Servlet: A servlet is a Java class that runs on a web server (servlet container such as Apache Tomcat) and handles client requests and generates dynamic responses, normally for HTTP. It extends HttpServlet and overrides methods such as doGet() and doPost(). The container manages its lifecycle (init(), service(), destroy()). Servlets are platform independent, efficient (one thread per request) and secure.

Session handling

HTTP is stateless, so a servlet uses the HttpSession object to remember a user across requests. The container creates a unique session ID and sends it to the browser as the cookie JSESSIONID (or through URL rewriting if cookies are disabled). The server keeps the session data in memory.

Main methods:

• request.getSession() / getSession(false) - get or create the session
• setAttribute(name, value) / getAttribute(name) - store and read data
• removeAttribute(name)
• setMaxInactiveInterval(seconds) - timeout
• invalidate() - destroy the session

Example

LoginServlet.java

import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class LoginServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String user = request.getParameter("username");
        String pass = request.getParameter("password");

        if ("admin".equals(user) && "1234".equals(pass)) {
            HttpSession session = request.getSession();      // create session
            session.setAttribute("user", user);              // store data
            session.setMaxInactiveInterval(15 * 60);         // 15 minutes
            response.sendRedirect("ProfileServlet");
        } else {
            response.sendRedirect("login.html");
        }
    }
}

ProfileServlet.java

public class ProfileServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        HttpSession session = request.getSession(false);     // existing session only
        if (session != null && session.getAttribute("user") != null) {
            out.println("<h2>Welcome, " + session.getAttribute("user") + "</h2>");
            out.println("<a href='LogoutServlet'>Logout</a>");
        } else {
            response.sendRedirect("login.html");
        }
    }
}

LogoutServlet.java

public class LogoutServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        HttpSession session = request.getSession(false);
        if (session != null) session.invalidate();
        response.sendRedirect("login.html");
    }
}

After a successful login the user id is stored in the session; every later servlet checks the session to confirm the user is logged in, and logout invalidates it.

contact.html

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Contact Us - Pokhara University</title>
</head>
<body>
    <h2>Contact Us - Pokhara University</h2>
    <form action="ContactServlet" method="post">
        <p>Name: <input type="text" name="name" required></p>
        <p>Email: <input type="email" name="email" required></p>
        <p>Phone Number: <input type="tel" name="phone" required></p>
        <p>Subject: <input type="text" name="subject" required></p>
        <p>Message:<br>
           <textarea name="message" rows="5" cols="40" required></textarea></p>
        <p><input type="submit" value="Send"> <input type="reset" value="Clear"></p>
    </form>
</body>
</html>

ContactServlet.java

import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class ContactServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        response.setContentType("text/html;charset=UTF-8");
        request.setCharacterEncoding("UTF-8");

        String name    = request.getParameter("name");
        String email   = request.getParameter("email");
        String phone   = request.getParameter("phone");
        String subject = request.getParameter("subject");
        String message = request.getParameter("message");

        PrintWriter out = response.getWriter();
        out.println("<html><body>");
        out.println("<h2>Thank you for contacting Pokhara University</h2>");
        out.println("<table border='1' cellpadding='6'>");
        out.println("<tr><td>Name</td><td>" + escape(name) + "</td></tr>");
        out.println("<tr><td>Email</td><td>" + escape(email) + "</td></tr>");
        out.println("<tr><td>Phone</td><td>" + escape(phone) + "</td></tr>");
        out.println("<tr><td>Subject</td><td>" + escape(subject) + "</td></tr>");
        out.println("<tr><td>Message</td><td>" + escape(message) + "</td></tr>");
        out.println("</table>");
        out.println("</body></html>");
    }

    // simple HTML escaping to avoid XSS
    private String escape(String s) {
        if (s == null) return "";
        return s.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
    }
}

web.xml mapping (not needed if @WebServlet("/ContactServlet") is used on the class)

<servlet>
    <servlet-name>ContactServlet</servlet-name>
    <servlet-class>ContactServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>ContactServlet</servlet-name>
    <url-pattern>/ContactServlet</url-pattern>
</servlet-mapping>

When the form is submitted with method="post", the browser sends the data in the request body; the container calls doPost(), which reads the values with request.getParameter() and writes them back as an HTML page.

JSP (JavaServer Pages) is a server-side technology for creating dynamic web pages by embedding Java code in HTML using tags such as scriptlets <% %>, expressions <%= %>, declarations <%! %>, directives <%@ %> and JSTL/EL. A JSP is converted into a servlet by the container, so it has the same power as a servlet but is easier to write for presentation.

JSP lifecycle

1. Translation: the container converts page.jsp into a servlet source file page_jsp.java.
2. Compilation: the generated source is compiled into page_jsp.class.
3. Class loading and instantiation: the class is loaded and an instance is created.
4. Initialization: jspInit() is called once.
5. Request processing: _jspService(request, response) is called for every request (in a new thread).
6. Destruction: jspDestroy() is called once when the page is removed or the server shuts down.

Translation and compilation happen on the first request (or when the JSP file changes), so later requests are fast.

Lifecycle methods

(jspInit() and jspDestroy() are declared in JspPage; _jspService() in HttpJspPage.)

Example: lifecycle.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8" %>
<%!
    int count;

    public void jspInit() {
        count = 0;
        System.out.println("jspInit() called");
    }

    public void jspDestroy() {
        System.out.println("jspDestroy() called");
    }
%>
<html>
<body>
    <% count++; %>
    <h3>This page has been visited <%= count %> time(s).</h3>
</body>
</html>

jspInit() runs once and sets count to 0; each request runs _jspService() (the scriptlet and HTML) and increments the counter; jspDestroy() runs when the container unloads the page.

Assumptions

• Database: shop (MySQL), user root, blank password.
• Table:

CREATE TABLE product (
    id INT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(100),
    category VARCHAR(50),
    price DECIMAL(10,2)
);

• The MySQL JDBC driver JAR is in WEB-INF/lib.

products.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8" import="java.sql.*" %>
<html>
<head><title>Electronics Products</title></head>
<body>
<h2>Electronics products costing more than Rs. 5,000</h2>
<table border="1" cellpadding="6">
    <tr><th>Product Name</th><th>Category</th><th>Price (Rs)</th></tr>
<%
    Connection con = null;
    PreparedStatement ps = null;
    ResultSet rs = null;
    try {
        Class.forName("com.mysql.cj.jdbc.Driver");
        con = DriverManager.getConnection("jdbc:mysql://localhost:3306/shop", "root", "");

        String sql = "SELECT name, category, price FROM product WHERE category = ? AND price > ?";
        ps = con.prepareStatement(sql);
        ps.setString(1, "Electronics");
        ps.setDouble(2, 5000);
        rs = ps.executeQuery();

        while (rs.next()) {
%>
    <tr>
        <td><%= rs.getString("name") %></td>
        <td><%= rs.getString("category") %></td>
        <td><%= rs.getDouble("price") %></td>
    </tr>
<%
        }
    } catch (Exception e) {
        out.println("<tr><td colspan='3'>Error: " + e.getMessage() + "</td></tr>");
    } finally {
        if (rs != null) rs.close();
        if (ps != null) ps.close();
        if (con != null) con.close();
    }
%>
</table>
</body>
</html>

The program loads the driver, opens a connection, runs a parameterised query that filters on category and price, loops over the ResultSet to print each row in an HTML table, and finally closes the resources.

MVC (Model-View-Controller) is a software design pattern that separates an application into three interconnected components:

• Model: represents the data and business logic (database access, rules, validation). It is independent of the user interface.
• View: the presentation layer; displays data from the model to the user (HTML, JSP, templates).
• Controller: receives user requests, calls the model to process data, and chooses the view to return.

Flow: the user sends a request, the Controller handles it, asks the Model for or updates data, then passes the result to the View, which renders the response.

Contribution to web development

• Separation of concerns: designers work on views while programmers work on models and controllers.
• Easier maintenance and testing, since each part can be changed or tested independently.
• Code reuse: the same model can serve several views (web page, mobile app, API).
• Parallel development by a team.
• Clean URL routing and organised, scalable structure.
• Supports security and validation in a central place.

Two frameworks following MVC

1. Laravel (PHP): an open source PHP framework with expressive syntax.

• Model: Eloquent ORM maps database tables to classes (app/Models).
• View: Blade templating engine (resources/views).
• Controller: classes in app/Http/Controllers; routes defined in routes/web.php.
• Features: Artisan CLI, migrations, authentication, middleware, queues, built-in protection against CSRF and SQL injection.

2. Spring MVC (Java): a module of the Spring Framework for Java web applications.

• Front controller DispatcherServlet receives all requests and dispatches them to @Controller classes using handler mapping.
• Model holds data (Model/ModelAndView, entities with JPA/Hibernate).
• View is resolved by a view resolver (JSP, Thymeleaf).
• Features: dependency injection, annotation-based configuration, REST support, security and easy integration with other Spring modules.

Other examples: CodeIgniter, Symfony (PHP), Django (Python, MVT), ASP.NET MVC.

A Content Management System (CMS) is software that lets users create, edit, organise, publish and maintain digital content (text, images, video, documents) on a website without writing code. It separates content from design and stores it in a database.

Uses of CMS

• Create and publish web pages, blogs and news easily with a WYSIWYG editor.
• Manage text, images, audio, video and documents in a central library.
• Allow multiple users with roles and permissions (admin, editor, author) to work together.
• Control the look of the whole site through themes and templates.
• Extend functionality with plugins/modules (SEO, e-commerce, forms, analytics).
• Version control, scheduling of posts and workflow approval.
• Support SEO, multi-language content and responsive design.
• Reduce cost and time of development and maintenance.

Popular CMS in the market

1. WordPress: the most widely used CMS (powers over 40% of websites). Written in PHP and MySQL. Thousands of free themes and plugins; suitable for blogs, business sites and, with WooCommerce, online stores. Easy for beginners.
2. Joomla: open source PHP CMS, more flexible than WordPress for complex sites; strong user management, multilingual support and extensions. Moderate learning curve.
3. Drupal: powerful, highly secure and scalable PHP CMS used by governments and large organisations; strong taxonomy and custom content types; needs technical skill.
4. Shopify / Magento: e-commerce focused platforms for online stores (Shopify is hosted; Magento is open source).
5. Wix and Squarespace: hosted drag-and-drop website builders for non-technical users.
6. Headless CMS (Strapi, Contentful): deliver content through APIs to websites and apps.

Web service: a web service is a software component that exposes functionality over a network (usually HTTP) so that different applications, written in different languages and running on different platforms, can communicate. Data is exchanged in a standard format such as XML or JSON. Types: SOAP (with WSDL and UDDI) and RESTful services.

RESTful service: uses HTTP methods on resources identified by URLs: POST (create), GET (read), PUT (update), DELETE (delete).

Student RESTful endpoints (Spring Boot)

Student.java

public class Student {
    private int id;
    private String name;
    private String email;
    private double gpa;

    public Student() {}
    public Student(int id, String name, String email, double gpa) {
        this.id = id; this.name = name; this.email = email; this.gpa = gpa;
    }
    public int getId() { return id; }
    public void setId(int id) { this.id = id; }
    public String getName() { return name; }
    public void setName(String name) { this.name = name; }
    public String getEmail() { return email; }
    public void setEmail(String email) { this.email = email; }
    public double getGpa() { return gpa; }
    public void setGpa(double gpa) { this.gpa = gpa; }
}

StudentController.java

import java.util.*;
import org.springframework.http.*;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/students")
public class StudentController {

    private final List<Student> students = new ArrayList<>();

    // CREATE: POST /api/students
    @PostMapping
    public ResponseEntity<Student> create(@RequestBody Student s) {
        students.add(s);
        return new ResponseEntity<>(s, HttpStatus.CREATED);   // 201
    }

    // READ ALL: GET /api/students
    @GetMapping
    public List<Student> getAll() {
        return students;
    }
}

Usage

POST /api/students with body

{ "id": 1, "name": "Sita Sharma", "email": "sita@example.com", "gpa": 3.8 }

returns status 201 and the created object. GET /api/students returns

[ { "id": 1, "name": "Sita Sharma", "email": "sita@example.com", "gpa": 3.8 } ]

In a real application the list would be replaced by a database repository (JPA).

Vulnerability: a weakness or flaw in the design, implementation, configuration or operation of a web application that can be exploited to cause harm. Examples: unvalidated input, weak passwords, outdated software, misconfigured server, unencrypted data.

Threat: any potential danger or circumstance that could exploit a vulnerability and harm the application, data or users. A threat may be an attacker, malware, an insider, or a natural event. Example: a hacker who may steal customer data.

Attack: the actual attempt or act of exploiting a vulnerability to compromise confidentiality, integrity or availability. Examples: SQL injection, cross-site scripting (XSS), CSRF, session hijacking, brute force, denial of service (DoS).

Relationship: a threat agent uses an attack to exploit a vulnerability; risk exists when all three meet.

Protection

• Input validation and sanitisation on both client and server; whitelist valid input.
• Prepared statements / parameterised queries against SQL injection.
• Output encoding (htmlspecialchars) and Content Security Policy against XSS.
• CSRF tokens and SameSite cookies.
• Strong authentication: hashed passwords (bcrypt), multi-factor authentication, account lockout.
• Authorisation: least privilege and role-based access control.
• Secure session management: regenerate session IDs, HttpOnly/Secure cookies, timeouts.
• HTTPS/TLS to protect data in transit; encrypt sensitive data at rest.
• Keep software patched; update frameworks, libraries and server.
• Secure configuration: disable unused services, hide error details, change defaults.
• Firewall / WAF, rate limiting, logging and monitoring, regular backups.
• Security testing: vulnerability scans, penetration testing and code review.

Web application security is the practice of protecting websites, web applications and web services from attacks and misuse so that their data and functions remain confidential, intact and available (the CIA triad). It covers the code, the server, the database, the network and the users' interaction, and aims to stop threats such as SQL injection, XSS, CSRF, session hijacking, malware and DoS.

Best security practices in web development

1. Validate all input on the server side (type, length, format, whitelist); never trust client-side checks alone.
2. Prevent SQL injection using prepared statements / ORM; do not build queries by string concatenation.
3. Prevent XSS by encoding output (htmlspecialchars()), and use Content Security Policy.
4. Prevent CSRF with anti-CSRF tokens and SameSite cookies.
5. Use HTTPS/TLS everywhere and HSTS; never send passwords in plain text.
6. Strong authentication: store passwords hashed and salted (bcrypt/Argon2, never MD5), enforce password policy, use multi-factor authentication, limit login attempts.
7. Proper authorisation: check permissions on the server for every request; apply least privilege and role-based access control.
8. Secure session management: regenerate the session ID after login, set HttpOnly, Secure flags, use timeouts and destroy sessions on logout.
9. Error handling: show generic error messages to users and log details privately.
10. Secure file uploads: check type and size, rename files, store outside the web root.
11. Keep everything updated: frameworks, libraries, CMS plugins, server and OS patches.
12. Secure configuration: disable directory listing, remove default accounts, restrict database privileges, protect configuration files.
13. Protect sensitive data: encrypt at rest, do not store unnecessary data, manage API keys safely.
14. Use firewall / WAF, rate limiting and backups.
15. Logging, monitoring and testing: audit logs, regular vulnerability scans, penetration testing and code reviews; follow OWASP Top 10 guidelines.

Following these practices (defence in depth) greatly reduces the risk of data breaches and service disruption.

PHP can send email from a script using the built-in mail() function, which passes the message to the server's mail transfer agent (sendmail, or an SMTP server configured in php.ini).

Syntax

mail(string $to, string $subject, string $message, $headers = "", $parameters = "");

It returns true if the mail was accepted for delivery (not guaranteed to be delivered) and false otherwise.

Example

<?php
$to      = "student@example.com";
$subject = "Welcome";
$message = "<h3>Hello!</h3><p>Welcome to our site.</p>";
$headers  = "MIME-Version: 1.0\r\n";
$headers .= "Content-type: text/html; charset=UTF-8\r\n";
$headers .= "From: admin@mysite.com\r\n";

if (mail($to, $subject, $message, $headers)) {
    echo "Email sent successfully";
} else {
    echo "Email sending failed";
}
?>

Configuration (php.ini): SMTP, smtp_port and sendmail_from (Windows) or sendmail_path (Linux).

Limitations: no authentication, attachments are hard to handle, and mail often lands in spam. For real applications libraries such as PHPMailer or SwiftMailer are used, which support SMTP authentication, TLS, HTML mail and attachments. Header input should be validated to prevent email header injection.

A Java Servlet is a server-side Java class that extends the capabilities of a web server by processing client requests (mostly HTTP) and generating dynamic responses. Servlets run inside a servlet container (Tomcat, Jetty, GlassFish) which manages them.

Key points

• Created by extending HttpServlet and overriding doGet() / doPost(); they use the javax.servlet (or jakarta.servlet) API.
• Lifecycle: init() called once, service() called per request (dispatches to doGet/doPost), destroy() called once at the end.
• Each request is handled by a new thread of the same servlet instance, which makes servlets faster than CGI (which creates a new process).
• Platform independent, robust and secure because of Java.
• Supports session tracking through cookies, HttpSession, URL rewriting and hidden fields.
• Configured in web.xml or with the @WebServlet annotation.

Example

@WebServlet("/hello")
public class HelloServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse res)
            throws ServletException, IOException {
        res.setContentType("text/html");
        res.getWriter().println("<h1>Hello Servlet</h1>");
    }
}

Servlets form the basis of JSP and frameworks such as Spring MVC and Struts.

Web development is the process of designing, building and maintaining websites and web applications that run in a web browser over the internet or an intranet. It includes web design, front-end (client-side) development, back-end (server-side) development, database management, testing and deployment.

Client-side scripting

Scripts are downloaded with the page and executed by the user's browser. They handle presentation and interaction: form validation, animations, dynamic content, event handling, AJAX. Source code is visible to the user. Languages: HTML, CSS, JavaScript, TypeScript (frameworks: React, Vue, Angular).

<script>
function validate() {
    var n = document.getElementById("name").value;
    if (n === "") { alert("Name is required"); return false; }
    return true;
}
</script>
<form onsubmit="return validate()">
    <input type="text" id="name"> <input type="submit">
</form>

Server-side scripting

Scripts are executed on the web server; only the generated output (HTML) is sent to the browser. They access databases, files and sessions, perform authentication and business logic. The code is hidden from users and is more secure. Languages: PHP, JSP/Servlets (Java), ASP.NET, Python (Django), Node.js.

<?php
$conn = new mysqli("localhost", "root", "", "college");
$result = $conn->query("SELECT name FROM student");
while ($row = $result->fetch_assoc()) {
    echo $row['name'] . "<br>";
}
?>

Modern sites use both together: client-side for the interface and server-side for data and logic.

Cookies

A cookie is a small text file (about 4 KB) that the server asks the browser to store on the client's computer. The browser sends it back with every later request to the same site, which helps the stateless HTTP protocol to remember users (preferences, "remember me").

Sessions

A session stores user data on the server and gives the browser only a unique session ID (cookie PHPSESSID). It lasts until the user closes the browser, logs out or the session times out. It is more secure than cookies and is used for login status and shopping carts.

Working with cookies in PHP

Syntax: setcookie(name, value, expire, path, domain, secure, httponly); It must be called before any output.

Create and read a cookie

<?php
// create cookie valid for 7 days
setcookie("user", "Ram", time() + (7 * 24 * 60 * 60), "/");
?>
<html>
<body>
<?php
if (isset($_COOKIE["user"])) {
    echo "Welcome " . $_COOKIE["user"];
} else {
    echo "Cookie not set. Reload the page.";
}
?>
</body>
</html>

Modify a cookie: call setcookie() again with the same name and a new value.

Delete a cookie

setcookie("user", "", time() - 3600, "/");

Check whether cookies are enabled: set a test cookie and check count($_COOKIE) > 0 on the next request.

Session example

<?php
session_start();
$_SESSION["user"] = "Ram";
echo "Hello " . $_SESSION["user"];
// session_unset(); session_destroy();   // to log out
?>

Assumptions: database college, table

CREATE TABLE users (
    id INT PRIMARY KEY AUTO_INCREMENT,
    email VARCHAR(100) UNIQUE,
    password VARCHAR(255)
);

register.php (form and processing in one file)

<?php
$errors = [];
$success = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $email    = trim($_POST["email"] ?? "");
    $password = $_POST["password"] ?? "";
    $retype   = $_POST["retype"] ?? "";

    // validation
    if ($email === "") {
        $errors[] = "Email is required.";
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email format.";
    }

    if ($password === "") {
        $errors[] = "Password is required.";
    } elseif (strlen($password) < 8) {
        $errors[] = "Password must be at least 8 characters.";
    }

    if ($retype !== $password) {
        $errors[] = "Passwords do not match.";
    }

    // insert if valid
    if (empty($errors)) {
        $conn = new mysqli("localhost", "root", "", "college");
        if ($conn->connect_error) {
            die("Connection failed: " . $conn->connect_error);
        }
        $hash = password_hash($password, PASSWORD_DEFAULT);

        $stmt = $conn->prepare("INSERT INTO users (email, password) VALUES (?, ?)");
        $stmt->bind_param("ss", $email, $hash);

        if ($stmt->execute()) {
            $success = "Registration successful.";
        } else {
            $errors[] = "Error: " . $stmt->error;   // e.g. duplicate email
        }
        $stmt->close();
        $conn->close();
    }
}
?>
<!DOCTYPE html>
<html>
<body>
<?php
foreach ($errors as $e) echo "<p style='color:red'>" . htmlspecialchars($e) . "</p>";
if ($success) echo "<p style='color:green'>$success</p>";
?>
<form method="post" action="">
    Email: <input type="text" name="email"
                  value="<?php echo htmlspecialchars($email ?? ''); ?>"><br><br>
    Password: <input type="password" name="password"><br><br>
    Retype Password: <input type="password" name="retype"><br><br>
    <input type="submit" value="Register">
</form>
</body>
</html>

The script checks that fields are filled, the email format is valid (FILTER_VALIDATE_EMAIL), the password length is adequate and both passwords match. Only valid data is inserted, using a prepared statement and a hashed password (password_hash).

Importance of functions in PHP

A function is a named block of code that performs a specific task and can be called many times.

• Reusability: write once, use anywhere, avoiding repeated code.
• Modularity: a large program is divided into small manageable parts.
• Easy maintenance and debugging: a change is made in one place only.
• Readability: meaningful function names make the code clear.
• Abstraction: the caller needs to know only what the function does, not how.
• Parameters and return values: the same logic can work on different data.
• Smaller scripts and team work: functions can be developed and tested separately.

Syntax:

function functionName($param1, $param2) {
    // statements
    return $value;
}

Palindrome check using a function

<?php
function isPalindrome($num) {
    $original = $num;
    $reverse  = 0;
    while ($num > 0) {
        $digit   = $num % 10;
        $reverse = $reverse * 10 + $digit;
        $num     = (int)($num / 10);
    }
    return $original == $reverse;
}

$result = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $n = (int)$_POST["number"];
    $result = isPalindrome($n)
        ? "$n is a palindrome."
        : "$n is not a palindrome.";
}
?>
<form method="post">
    Enter a number: <input type="number" name="number" min="0">
    <input type="submit" value="Check">
</form>
<p><?php echo $result; ?></p>

Example: 121 reversed is 121, so "121 is a palindrome"; 123 reversed is 321, so it is not a palindrome.

Servlet: a Java class running on a web server (servlet container) that processes client requests and generates dynamic responses, mainly HTTP. It extends HttpServlet and overrides doGet() / doPost().

Why a servlet is different from JSP

Architecture of Java servlets

1. The client (browser) sends an HTTP request to the web server.
2. The web server / servlet container (e.g. Tomcat) receives it. The container consists of the web server plus the servlet engine.
3. The container matches the URL to a servlet using web.xml or @WebServlet, loads the servlet class if it is not already loaded and creates an instance.
4. It creates HttpServletRequest and HttpServletResponse objects and, for each request, starts a thread that calls the servlet's service() method, which calls doGet() or doPost().
5. The servlet may use JDBC to access a database, or use sessions, cookies and other resources.
6. The servlet writes the result to the response object, which the container sends back to the client as an HTTP response.
7. When the application stops the container calls destroy().

Browser -> HTTP Request -> Web Server + Servlet Container
                              |  (init once, service per request)
                              v
                          Servlet -> Database / Resources
                              |
Browser <- HTTP Response <----+

The container provides the services of threading, lifecycle management, security and session handling, so the developer concentrates on application logic.

Assumption: after a successful login, login.jsp stores the user's id in the session with session.setAttribute("user_id", id) and redirects to index.jsp. Database blogdb on MySQL.

index.jsp

<%
    // session check at the first line
    if (session.getAttribute("user_id") == null) {
        response.sendRedirect("login.jsp");
        return;
    }
%>
<%@ page language="java" contentType="text/html; charset=UTF-8" import="java.sql.*" %>
<html>
<head><title>All Blogs</title></head>
<body>
<h2>All Blogs</h2>
<a href="logout.jsp">Logout</a>
<table border="1" cellpadding="6">
    <tr><th>Title</th><th>Contents</th><th>Author</th><th>Action</th></tr>
<%
    int currentUser = (Integer) session.getAttribute("user_id");
    Connection con = null;
    PreparedStatement ps = null;
    ResultSet rs = null;
    try {
        Class.forName("com.mysql.cj.jdbc.Driver");
        con = DriverManager.getConnection("jdbc:mysql://localhost:3306/blogdb", "root", "");

        String sql = "SELECT b.id, b.user_id, b.title, b.contents, u.first_name, u.last_name "
                   + "FROM tbl_blogss b JOIN tbl_users u ON b.user_id = u.id";
        ps = con.prepareStatement(sql);
        rs = ps.executeQuery();

        while (rs.next()) {
            int blogId = rs.getInt("id");
            int owner  = rs.getInt("user_id");
%>
    <tr>
        <td><%= rs.getString("title") %></td>
        <td><%= rs.getString("contents") %></td>
        <td><%= rs.getString("first_name") %> <%= rs.getString("last_name") %></td>
        <td>
        <% if (owner == currentUser) { %>
            <a href="edit.jsp?id=<%= blogId %>">Edit</a> |
            <a href="delete.jsp?id=<%= blogId %>"
               onclick="return confirm('Delete this blog?');">Delete</a>
        <% } else { %>
            -
        <% } %>
        </td>
    </tr>
<%
        }
    } catch (Exception e) {
        out.println("Error: " + e.getMessage());
    } finally {
        if (rs != null) rs.close();
        if (ps != null) ps.close();
        if (con != null) con.close();
    }
%>
</table>
</body>
</html>

All blogs are listed for every logged-in user, but the Edit and Delete links are printed only when the blog's user_id equals the session user's id. edit.jsp and delete.jsp must also re-check ownership with WHERE id=? AND user_id=? so that users cannot change others' blogs by typing the URL.

Importance of JSP

• Easy to write: HTML with embedded Java, so designers and programmers can work separately.
• Automatically translated, compiled and reloaded by the container (no manual compilation).
• Platform independent ("write once, run anywhere") and fast, because the compiled servlet is reused for each request.
• Separates presentation from business logic (works with servlets/JavaBeans in the MVC pattern).
• Has implicit objects (request, response, session, out, application) and supports custom tags, JSTL and Expression Language.
• Full access to the Java API and JDBC; supports session tracking and reuse of code through include directives and tag libraries.
• Strong support from application servers and frameworks, and it is secure and scalable.

Steps in a JDBC application

1. Import the packages java.sql.*.
2. Load and register the driver: Class.forName("com.mysql.cj.jdbc.Driver");
3. Establish the connection: DriverManager.getConnection(url, user, password).
4. Create a statement: Statement, PreparedStatement or CallableStatement.
5. Execute the query: executeQuery() for SELECT, executeUpdate() for INSERT/UPDATE/DELETE.
6. Process the result: iterate the ResultSet with next() and getXxx().
7. Close the resources: ResultSet, statement and connection.

Sample code

import java.sql.*;

public class JdbcDemo {
    public static void main(String[] args) {
        String url = "jdbc:mysql://localhost:3306/college";
        try {
            Class.forName("com.mysql.cj.jdbc.Driver");                       // step 2
            Connection con = DriverManager.getConnection(url, "root", "");   // step 3
            PreparedStatement ps =
                con.prepareStatement("SELECT id, name FROM student WHERE id > ?"); // step 4
            ps.setInt(1, 0);
            ResultSet rs = ps.executeQuery();                                // step 5
            while (rs.next()) {                                              // step 6
                System.out.println(rs.getInt("id") + " " + rs.getString("name"));
            }
            rs.close(); ps.close(); con.close();                             // step 7
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

MVC (Model-View-Controller) is a design pattern that divides an application into three parts:

• Model: data and business logic; communicates with the database.
• View: the user interface that shows the data.
• Controller: accepts user input, calls the model and selects the view.

It gives separation of concerns, easier maintenance, testing, reuse and team development.

Two PHP frameworks

1. Laravel

• Most popular modern PHP framework, open source, follows MVC strictly.
• Model: Eloquent ORM - each table is a class (User::where('status', 1)->get()).
• View: Blade template engine (resources/views/*.blade.php).
• Controller: classes in app/Http/Controllers, routes in routes/web.php.
• Features: Artisan command line, database migrations, middleware, authentication scaffolding, queues, caching, CSRF and SQL injection protection, Composer package management.

2. CodeIgniter

• Lightweight, fast PHP framework with a small footprint and simple configuration.
• Model: classes in app/Models using the query builder; View: PHP files in app/Views; Controller: classes in app/Controllers (URL segments map to controller/method).
• Features: easy to learn, good documentation, built-in security helpers (XSS filtering, CSRF), form validation, session and caching libraries.

(Others: Symfony, CakePHP, Yii.)

UDDI (Universal Description, Discovery and Integration): an XML-based registry standard (a "yellow pages" for web services) where businesses publish and discover web services. A service provider registers its service in the UDDI registry; a client searches the registry to find it and obtains its WSDL location. A UDDI entry holds:

• White pages: business name, contact information.
• Yellow pages: classification of services by category.
• Green pages: technical details (binding, WSDL location) needed to call the service.

Web service

A web service is a software component that provides functionality over a network, typically HTTP, using standard XML/JSON formats so that applications on different platforms and languages can communicate. Characteristics: platform independent, loosely coupled, self-describing, reusable, discoverable.

Main SOAP-based web service technologies:

• SOAP for the message format,
• WSDL for describing the service,
• UDDI for publishing and discovery.

Interaction: provider publishes WSDL to UDDI, requester finds it, then binds and invokes the service with SOAP messages.

RESTful web service

REST (Representational State Transfer) is an architectural style in which resources are identified by URLs and manipulated with the standard HTTP methods.

• GET read, POST create, PUT update, DELETE remove.
• Stateless: each request carries all the information needed.
• Data formats: JSON (most common), XML, plain text.
• Uses standard HTTP status codes (200, 201, 404, 500).
• Cacheable, uniform interface, client-server separation.

Example: GET /api/students/5 returns {"id":5,"name":"Ram"}.

REST is widely used for mobile apps and public APIs because of its simplicity and speed.

Network threats

Threats that attack the network infrastructure and the data travelling over it.

• Information gathering: port scanning, ping sweeps, traceroute and sniffing to discover hosts and services.
• Sniffing / eavesdropping: capturing unencrypted traffic (passwords, cookies) with packet sniffers.
• Spoofing: forging IP, MAC or DNS addresses to impersonate a trusted host.
• Session hijacking / man-in-the-middle: taking over or intercepting an active session.
• Denial of Service (DoS/DDoS): flooding a server so legitimate users cannot access it (SYN flood).
• Replay attacks and insecure router/switch configuration.

Countermeasures: use firewalls and intrusion detection/prevention systems; encrypt traffic with SSL/TLS, IPSec and VPN; use strong authentication; segment the network (DMZ); disable unnecessary ports and protocols; secure and patch routers and switches; use ingress/egress filtering and rate limiting against DoS.

Host threats

Threats directed at the individual server or machine hosting the application (OS, web server, database).

• Viruses, worms and Trojan horses: malicious software.
• Footprinting: collecting information about OS, services and versions.
• Password attacks: brute force and dictionary attacks.
• Unpatched software: exploiting known vulnerabilities and buffer overflows.
• Misconfiguration: default accounts, open ports, unnecessary services, weak file permissions.
• Unauthorised access / privilege escalation and arbitrary code execution.
• Denial of service against the host.

Countermeasures: apply patches and updates promptly; install antivirus and host-based firewall; disable unused services, ports and default accounts; enforce strong passwords and account lockout; apply least privilege and strict file permissions; enable auditing and logging; harden the OS and web server configuration; regular backups and security scans.

Authentication: the process of verifying the identity of a user or system (who are you?), e.g. by username and password, OTP, fingerprint, smart card or certificate. Factors: something you know, something you have, something you are.

Authorization: deciding what an authenticated user is allowed to do (what can you access?), e.g. role-based permissions such as admin versus normal user. Authentication comes first; authorization follows.

Common threats and countermeasures for a web application

Other measures: keep software updated, log and monitor, and perform regular security testing.

A Java framework is a pre-written, reusable collection of classes, libraries and conventions that provides a standard structure for building Java applications, so developers do not have to write common functionality from scratch. The framework controls the flow ("inversion of control") and calls the developer's code.

Benefits: faster development, tested and secure code, standard structure (often MVC), easier maintenance, community support.

Popular Java frameworks

• Spring / Spring Boot: dependency injection, MVC, REST, security, data access; the most widely used for enterprise and microservices.
• Hibernate: object-relational mapping (ORM) framework that maps Java classes to database tables, reducing JDBC code.
• Struts: MVC framework for web applications using an action-based approach.
• JSF (JavaServer Faces): component-based UI framework.
• Apache Wicket, Vaadin, Play: other web frameworks.
• JUnit: testing framework.

Example (Spring Boot controller)

@RestController
public class HelloController {
    @GetMapping("/hello")
    public String hello() { return "Hello, Spring!"; }
}

The foundation of security rests on a few basic goals and principles that every secure system must satisfy.

Core security goals (CIA triad)

• Confidentiality: information is accessible only to authorised users (encryption, access control).
• Integrity: data is accurate and not modified without permission (hashing, digital signatures, checksums).
• Availability: systems and data are available when needed (redundancy, backups, DoS protection).

Supporting services

• Authentication: verifying identity.
• Authorization: granting access rights.
• Non-repudiation: a user cannot deny an action (digital signatures, logs).
• Auditing / accountability: recording who did what.

Basic principles: least privilege, defence in depth, fail-safe defaults, separation of duties, minimising the attack surface, and keeping design simple.

Web security basics: input validation, secure session management, encryption (HTTPS), secure configuration and regular patching.

Together these provide the base on which secure web applications are designed.

Basic protocols used in the internet

A protocol is a set of rules for communication between computers.

Client-side vs server-side scripting

Database setup

CREATE DATABASE `STU DB`;
USE `STU DB`;
CREATE TABLE student (
    stuid    INT PRIMARY KEY,
    stuname  VARCHAR(100),
    address  VARCHAR(150),
    joindate DATE,
    faculty  VARCHAR(50),
    fee      DECIMAL(10,2)
);

student.php (insert and retrieve)

<?php
$conn = new mysqli("localhost", "root", "", "STU DB");
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// ---------- INSERT ----------
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $id       = (int)$_POST["stuid"];
    $name     = $_POST["stuname"];
    $address  = $_POST["address"];
    $joindate = $_POST["joindate"];
    $faculty  = $_POST["faculty"];
    $fee      = (float)$_POST["fee"];

    $stmt = $conn->prepare(
        "INSERT INTO student (stuid, stuname, address, joindate, faculty, fee)
         VALUES (?, ?, ?, ?, ?, ?)");
    $stmt->bind_param("issssd", $id, $name, $address, $joindate, $faculty, $fee);

    if ($stmt->execute()) {
        echo "<p>Record inserted successfully.</p>";
    } else {
        echo "<p>Error: " . $stmt->error . "</p>";
    }
    $stmt->close();
}
?>
<form method="post" action="">
    ID: <input type="number" name="stuid" required><br>
    Name: <input type="text" name="stuname" required><br>
    Address: <input type="text" name="address"><br>
    Join Date: <input type="date" name="joindate"><br>
    Faculty: <input type="text" name="faculty"><br>
    Fee: <input type="number" step="0.01" name="fee"><br>
    <input type="submit" value="Insert">
</form>

<h3>Student Records</h3>
<table border="1" cellpadding="5">
<tr><th>ID</th><th>Name</th><th>Address</th><th>Join Date</th><th>Faculty</th><th>Fee</th></tr>
<?php
// ---------- RETRIEVE ----------
$result = $conn->query("SELECT * FROM student");
if ($result && $result->num_rows > 0) {
    while ($row = $result->fetch_assoc()) {
        echo "<tr><td>" . $row['stuid'] . "</td><td>" . htmlspecialchars($row['stuname']) .
             "</td><td>" . htmlspecialchars($row['address']) . "</td><td>" . $row['joindate'] .
             "</td><td>" . htmlspecialchars($row['faculty']) . "</td><td>" . $row['fee'] . "</td></tr>";
    }
} else {
    echo "<tr><td colspan='6'>No records found</td></tr>";
}
$conn->close();
?>
</table>

The script connects as root with a blank password to the database STU DB, inserts a record with a prepared statement when the form is submitted, and then retrieves all rows and shows them in a table.

Array: a variable that stores multiple values under a single name, each accessed by a key (index). PHP arrays are ordered maps and can hold values of mixed types. Types: indexed, associative and multidimensional.

Indexed array example:

$colors = array("Red", "Green", "Blue");   // or ["Red","Green","Blue"]
echo $colors[1];                           // Green

Associative array

Uses named keys (strings) instead of numeric indexes, so that each value is accessed by a meaningful name.

<?php
$student = array(
    "name"    => "Ram",
    "age"     => 20,
    "faculty" => "BCA"
);
echo $student["name"];          // Ram
$student["gpa"] = 3.6;          // add an element

foreach ($student as $key => $value) {
    echo "$key : $value <br>";
}
?>

Output: name : Ram, age : 20, faculty : BCA, gpa : 3.6.

Multidimensional array

An array that contains one or more arrays as its elements; used for tables or matrices (rows and columns).

<?php
$students = array(
    array("id" => 1, "name" => "Ram",  "marks" => 78),
    array("id" => 2, "name" => "Sita", "marks" => 85),
    array("id" => 3, "name" => "Hari", "marks" => 69)
);

echo $students[1]["name"];      // Sita

foreach ($students as $s) {
    echo $s["id"] . " " . $s["name"] . " " . $s["marks"] . "<br>";
}

// numeric 2D array
$matrix = array(array(1, 2), array(3, 4));
echo $matrix[1][0];             // 3
?>

Useful functions: count(), array_keys(), array_values(), array_push(), sort(), ksort(), in_array(), print_r().

Session: a session is a way of storing information about a user on the server so that it is available across multiple pages of a website. Because HTTP is stateless, the server creates a unique session ID (sent to the browser as the cookie PHPSESSID) and keeps the data in the $_SESSION superglobal array. A session lasts until the user closes the browser, logs out, or it times out.

Use of sessions in PHP

• Keep a user logged in while moving from page to page.
• Store user information (id, name, role) for authorisation.
• Hold a shopping cart or multi-page form data.
• Pass data between pages without placing it in the URL; more secure than cookies because the data stays on the server.
• Track user activity and implement timeouts.

Functions: session_start() (must be first, before any output), $_SESSION['key'], session_unset() (remove variables), session_destroy() (end the session), session_regenerate_id().

Example

login.php

<?php
session_start();
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if ($_POST["user"] == "admin" && $_POST["pass"] == "1234") {
        $_SESSION["username"] = $_POST["user"];
        header("Location: dashboard.php");
        exit;
    } else {
        echo "Invalid login";
    }
}
?>
<form method="post">
    User: <input type="text" name="user">
    Password: <input type="password" name="pass">
    <input type="submit" value="Login">
</form>

dashboard.php

<?php
session_start();
if (!isset($_SESSION["username"])) {
    header("Location: login.php");
    exit;
}
echo "Welcome, " . htmlspecialchars($_SESSION["username"]);
echo " <a href='logout.php'>Logout</a>";

logout.php

<?php
session_start();
session_unset();
session_destroy();
header("Location: login.php");

Servlet: a Java class that runs inside a servlet container (e.g. Tomcat) and handles client requests to produce dynamic web content. It extends HttpServlet and overrides doGet() / doPost().

Servlet vs JSP

Every JSP is finally converted into a servlet.

Servlet lifecycle (controlled by the container)

1. Loading and instantiation: when the first request arrives (or at startup), the container loads the servlet class and creates a single instance.
2. Initialization - init(ServletConfig config): called once; used to set up resources such as a database connection.
3. Request handling - service(request, response): called for every request in a separate thread. For HTTP it dispatches to doGet(), doPost(), doPut(), doDelete().
4. Destruction - destroy(): called once when the servlet is removed or the server shuts down; used to release resources. After that the object is garbage collected.

public class DemoServlet extends HttpServlet {
    public void init() { System.out.println("init called"); }

    protected void doGet(HttpServletRequest req, HttpServletResponse res)
            throws ServletException, IOException {
        res.getWriter().println("Handling request");
    }

    public void destroy() { System.out.println("destroy called"); }
}

JDBC (Java Database Connectivity) is a Java API (java.sql, javax.sql) that lets Java programs connect to relational databases, send SQL statements and process results. A JDBC driver translates the Java calls into the database's protocol.

Components: DriverManager, Connection, Statement / PreparedStatement / CallableStatement, ResultSet, SQLException.

Driver types: Type 1 (JDBC-ODBC bridge), Type 2 (native API), Type 3 (network protocol), Type 4 (pure Java thin driver, most used).

Steps: load driver, create connection, create statement, execute query, process result, close connection.

Example (MySQL, table student(id, name, email))

import java.sql.*;

public class JdbcExample {
    public static void main(String[] args) {
        String url  = "jdbc:mysql://localhost:3306/college";
        String user = "root";
        String pass = "";

        try {
            // 1. load driver
            Class.forName("com.mysql.cj.jdbc.Driver");

            // 2. connect
            Connection con = DriverManager.getConnection(url, user, pass);

            // 3. INSERT
            PreparedStatement ins =
                con.prepareStatement("INSERT INTO student (id, name, email) VALUES (?, ?, ?)");
            ins.setInt(1, 101);
            ins.setString(2, "Sita");
            ins.setString(3, "sita@example.com");
            int rows = ins.executeUpdate();
            System.out.println(rows + " row inserted");

            // 4. SELECT
            Statement st = con.createStatement();
            ResultSet rs = st.executeQuery("SELECT id, name, email FROM student");
            while (rs.next()) {
                System.out.println(rs.getInt("id") + " " + rs.getString("name")
                                   + " " + rs.getString("email"));
            }

            // 5. close
            rs.close(); st.close(); ins.close(); con.close();
        } catch (ClassNotFoundException e) {
            System.out.println("Driver not found: " + e.getMessage());
        } catch (SQLException e) {
            System.out.println("Database error: " + e.getMessage());
        }
    }
}

The MySQL connector JAR must be on the classpath. executeQuery() is used for SELECT and returns a ResultSet; executeUpdate() is used for INSERT, UPDATE, DELETE and returns the number of affected rows.

JSP/Servlet directory structure

A Java web application follows the standard layout of the Servlet specification (Tomcat example):

TOMCAT_HOME/webapps/
 └── MyApp/                      (context root)
      ├── index.jsp, login.html  (public JSP/HTML pages)
      ├── css/, js/, images/     (static resources)
      └── WEB-INF/               (protected, not directly accessible by the browser)
           ├── web.xml           (deployment descriptor)
           ├── classes/          (compiled servlet .class files, in package folders)
           │     └── com/example/HelloServlet.class
           └── lib/              (JAR files: JDBC driver, JSTL, etc.)

• Context root: the application folder, which becomes the URL http://localhost:8080/MyApp/.
• WEB-INF: hidden from clients; holds configuration and code.
• web.xml: maps URLs to servlets, defines filters, listeners, welcome files and init parameters (not needed with @WebServlet).
• classes: compiled servlets and Java classes.
• lib: libraries.
• In an IDE project (Eclipse/NetBeans) sources are in src/main/java and web content in src/main/webapp; the IDE builds the layout above (a WAR file).

Steps to write a JSP/Servlet program

1. Install the JDK and a servlet container (Tomcat) and set JAVA_HOME.
2. Create the directory structure above (or a Dynamic Web Project in an IDE).
3. Write the servlet class extending HttpServlet and compile it with servlet-api.jar on the classpath; put the class in WEB-INF/classes.
4. Map the servlet in web.xml (or use @WebServlet).
5. Write the JSP/HTML page.
6. Deploy to webapps (or as a WAR), start Tomcat.
7. Open the URL in the browser and test.

Example

HelloServlet.java

import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class HelloServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse res)
            throws ServletException, IOException {
        res.setContentType("text/html");
        PrintWriter out = res.getWriter();
        out.println("<h2>Hello from Servlet</h2>");
    }
}

web.xml

<web-app>
  <servlet>
    <servlet-name>Hello</servlet-name>
    <servlet-class>HelloServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>Hello</servlet-name>
    <url-pattern>/hello</url-pattern>
  </servlet-mapping>
</web-app>

hello.jsp

<%@ page language="java" contentType="text/html" %>
<html>
<body>
  <h2>Hello from JSP</h2>
  <p>Current time: <%= new java.util.Date() %></p>
</body>
</html>

Run http://localhost:8080/MyApp/hello for the servlet and http://localhost:8080/MyApp/hello.jsp for the JSP.

WSDL (Web Services Description Language) is an XML-based language (W3C standard) that describes a web service: what it does, where it is located, which operations it offers, and what messages and data types it uses. It acts as a contract between the service provider and the client. A WSDL file is usually published in a UDDI registry and used with SOAP.

Uses of WSDL in web technology

• Describes the interface of a web service in a machine-readable way.
• Lets clients discover the available operations and how to call them.
• Tools can automatically generate client stubs and server skeletons (e.g. wsimport, "Add Service Reference"), saving coding time.
• Provides language and platform independence, enabling interoperability.
• Defines the data types (XML Schema) and the message formats exchanged.
• Specifies the protocol binding (SOAP over HTTP) and the endpoint address.
• Supports service registration in UDDI.

Structure of a WSDL document (root element <definitions>)

<definitions name="StudentService"
    targetNamespace="http://example.com/student"
    xmlns="http://schemas.xmlsoap.org/wsdl/"
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    xmlns:tns="http://example.com/student"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema">

  <types>
    <xsd:schema targetNamespace="http://example.com/student"/>
  </types>

  <message name="GetNameRequest"><part name="id" type="xsd:int"/></message>
  <message name="GetNameResponse"><part name="name" type="xsd:string"/></message>

  <portType name="StudentPortType">
    <operation name="getName">
      <input message="tns:GetNameRequest"/>
      <output message="tns:GetNameResponse"/>
    </operation>
  </portType>

  <binding name="StudentBinding" type="tns:StudentPortType">
    <soap:binding style="rpc" transport="http://schemas.xmlsoap.org/soap/http"/>
    <operation name="getName">
      <soap:operation soapAction="getName"/>
      <input><soap:body use="literal"/></input>
      <output><soap:body use="literal"/></output>
    </operation>
  </binding>

  <service name="StudentService">
    <port name="StudentPort" binding="tns:StudentBinding">
      <soap:address location="http://example.com/student"/>
    </port>
  </service>
</definitions>

Web application security fundamentals

1. Confidentiality: only authorised persons can read the data (encryption, access control).
2. Integrity: data is not altered without permission (hashing, digital signatures, validation).
3. Availability: the application stays accessible to legitimate users.
4. Authentication: verifying who the user is.
5. Authorization: controlling what the user may do.
6. Non-repudiation / auditing: keeping logs so that actions cannot be denied.
7. Secure session management and input validation.
8. Principles: least privilege, defence in depth, secure defaults, minimal attack surface.

Host threats

Threats against the servers and machines hosting the application.

• Viruses, worms and Trojans that infect the host.
• Footprinting: discovering OS, ports and services before an attack.
• Password cracking: brute force and dictionary attacks.
• Denial of service that exhausts host resources.
• Unauthorised access and privilege escalation through weak permissions.
• Unpatched software and buffer overflows that allow code execution.
• Misconfiguration: default accounts, unneeded services, open ports, directory listing.

Countermeasures: patching, antivirus, firewall, disabling unused services, strong passwords, least privilege, secure configuration, auditing.

Application threats

Threats caused by weaknesses in the application code and design.

• Input validation failures: SQL injection, cross-site scripting (XSS), command injection, buffer overflow.
• Broken authentication: weak passwords, credentials sent in clear text, cookie replay.
• Broken authorization: privilege elevation, accessing other users' data (insecure direct object references).
• Session management flaws: session hijacking, fixation, predictable IDs.
• Parameter manipulation: tampering with query strings, forms, cookies and hidden fields.
• Cross-site request forgery (CSRF).
• Sensitive data exposure: unencrypted storage, insecure transmission, verbose error messages.
• Improper exception handling and auditing weaknesses, repudiation.

Countermeasures: validate and encode all input and output, prepared statements, strong authentication and hashing, server-side authorisation, secure sessions, HTTPS, generic error messages, logging.

Vulnerability: a weakness or flaw in the design, coding, configuration or operation of a system that an attacker can exploit to compromise its confidentiality, integrity or availability. Examples: missing input validation (SQL injection), weak passwords, unpatched software, default configuration, unencrypted data, improper error handling.

Vulnerabilities arise from poor design, coding mistakes, third-party components and misconfiguration. A vulnerability is dangerous when a threat exists that can exploit it.

Design guidelines for a secure web application

1. Validate all input on the server using a whitelist (type, length, range, format); reject by default.
2. Use parameterised queries and avoid dynamic SQL; encode output to stop XSS.
3. Strong authentication: salted password hashing, password policy, account lockout, multi-factor authentication; never store plain-text passwords.
4. Authorization: least privilege, role-based access, check permissions on every request on the server.
5. Secure session management: random session IDs, regenerate on login, HttpOnly and Secure cookies, timeouts, proper logout.
6. Protect data in transit and at rest: HTTPS/TLS and encryption; do not put sensitive data in URLs.
7. Error handling and logging: show generic errors, log details securely, audit important events.
8. Defence in depth and fail securely: several layers of protection; deny access when something fails.
9. Minimise the attack surface: remove unused features, ports, accounts and sample files.
10. Secure configuration: change default passwords, harden server, restrict file permissions, separate environments.
11. Keep components updated: patch frameworks, libraries and plugins.
12. Protect against CSRF with tokens; secure file uploads.
13. Secure coding and testing: code reviews, vulnerability scanning, penetration testing, threat modelling, follow OWASP guidelines.
14. Separation of duties and keep the design simple so that it is easy to verify.

(a) MVC

MVC (Model-View-Controller) is an architectural pattern that splits an application into three connected parts so that data, presentation and control logic are kept separate.

• Model: handles data and business rules. It talks to the database (queries, validation, updates).
• View: the user interface. It displays data from the model as HTML, with little or no logic.
• Controller: receives the user's request, calls the model to get or change data, and selects the view to send back.

Flow: Browser request -> Controller -> Model (data) -> Controller -> View -> Response to browser.

(b) Advantages of using a framework

1. Faster development: ready-made libraries for routing, forms, sessions, validation and database access reduce the code to write.
2. Separation of concerns: designers work on views while developers work on models and controllers, so teamwork is easier.
3. Easy maintenance and testing: code is organised, reusable and can be unit tested part by part.
4. Security: built-in protection against SQL injection, XSS and CSRF.
5. Consistency: a standard structure and coding conventions make the code easier for new developers to read.
6. Community support: documentation, plugins and active communities.

(c) Two PHP frameworks

1. Laravel

• The most popular open-source PHP MVC framework.
• Uses the Blade templating engine for views, the Eloquent ORM for models, and expressive routing.
• Provides Artisan command-line tool, database migrations, authentication, queues, caching and Composer-based package management.
• Good for large, modern applications and RESTful APIs.

2. CodeIgniter

• A lightweight PHP framework with a small footprint and very fast performance.
• Needs little configuration and has simple documentation.
• Provides libraries for database, forms, email, sessions and security, and a clear MVC structure (models, views, controllers folders).
• Good for small and medium projects and for hosting with limited resources.

Other examples are Symfony, CakePHP and Yii.