给已有的网页增加一个评论系统，允许用户添加评论。需要注意的是security以及filter功能的实现。
Overview
This week, you will add a threaded commenting system to your project, and implement some basic security and filtering features for commenting. Specifically, you will need to create a database to store comments, read/write to the database, and implement basic filtering & security features for user comments. Additionally, you will be submitting your final project proposal.
Again the following info will be for PHP and MySQL, but feel free to use other languages you like. However, for this assignment, we are limiting you to use some form of SQL database.
Part 0: Final Project Proposal
Summary
For the last four weeks of the semester, you will work on a Final Project of your choice. For this week, you must submit a project proposal electronically as a PDF to your moderator by the start of your section.
There are no restrictions on what language, frameworks, or tools that you use, but your project:
- Cannot be any work you are getting paid for
- Cannot be any project or assignment for another course you are currently taking
- Must have clear, concrete objectives for each week
- Must include tools for testing, as this will be part of each week’s requirements
The proposal should be a PDF containing a summary of the project, your motivation for the project, and specific requirements for each week. Specifically, your proposal should include:
- Description/summary of project and your motivation for choosing this project
- Technical information about your project & specifications
- Planned final features
- Detailed timeline, including requirements week by week
We realize that it is difficult to plan your project week by week without actually implementing it, but this is a key part of the design process.
Caveats
In addition to individual final projects, we will allow
- Group projects (up to 3 students) - with approval from the moderators of the involved students
- Open Source or existing projects - subject to special approval from the TAs or professor Woodley
With either of these special cases, you must very clearly define your contributions specifically. For group projects, all moderators involved must be emailed the same proposal, and this proposal should clearly define the contributions of each member individually.
Before contacting the course staff with ideas for either one of these types of projects, you must have a clear description of what you plan on contributing individually, as grading each week is done on an individual basis.
Format and Examples
We expect you to follow a predefined format for your project proposals. The required format can be found here: Template.docx, Template.pdf
The following is an example of group proposal that follows this format: Example.pdf.
Updating Your Proposal
Each week, your actual progress may differ from your planned progress. We understand that this may happen, and as you implement your project each week, you should update your proposal as well. This may include any changes to technologies for your project. Stay in communication with your moderator – ask before making in drastic changes to your proposal in following weeks, and send him or her any updates to your proposal.
Part I: Database Design
If you are unfamiliar with SQL, we suggest you go through the W3 Schools SQL tutorial before continuing. Unlike previous iterations of this assignment you are strictly required to use a form of SQL database.
If you are not using LAMP stack and PHP, your framework will use other database structures. Make sure to read up on how they work and be able to describe how you designed your database to your moderator.
First, you will need to decide how you want to store your data in the database. Think about what table(s) you need and what columns each of those tables needs to have.
Feel free to use the PHPMyAdmin that is built into cPanel to construct your tables and play around with your design, but however you initially create your database, remember to include the SQL statement(s) that generated your schema in SVN (i.e. in your README or separate SQL files).
Hint for Comment Schema
There are many ways to implement comments in your database, but consider taking a tree-based approach using nested sets (preferred) or by just directly storing ids for each comment, and adding a field for the parent and/or child id of a comment.
Part II: Implement Commenting
The second step this week is to create some basic forms and display pages to show your comments. You will need to add to your content generated last week to add the information to your main portfolio page to allow it to interface with your comments.
Use CSS to style these pages and make them look presentable. How can you indicate that a comment is in reply to another? How do you place the tree of comments on a single page? Take a look at the comment pages on sites like Slashdot and Reddit for inspiration. If the template you used last week included some styling for comments, feel free to use that for this week’s styling.
Part III: Lock things Down
Next, secure your portfolio against malicious user input to comments. Using techniques such as prepared statements and proper string escaping, secure your code at minimum against SQL Injection Attacks and Cross-site Scripting Attacks. Use the internet to find resources about how to accomplish these goals with PHP.
Part IV: Filter Comments
For the last step, you will need to implement a basic content filtering system. You will need to compile a list of “red flag” words/phrases and acceptable replacement words/phrases. This list must have at least 5 entries, but feel free to add as many as you would like. When a user enters a comment with a “red flag” word or phrase, it should be automatically replaced with the corresponding replacement word. Store your “red flag” words/phrases and their corresponding replacements in the database.
Testing
For this week, write automated unit tests to test your commenting and security features. That is, you should have some test code that creates comments, replies to comments, checks for proper filtering, checks for proper SQL injection attack prevention, etc. Your tests should work by invoking the scripts you wrote to post comments, then verify they are properly placed in the database.