Assignment 2: Better munching

1. The assignment

Add some content to the web page you built for the previous assignment.

First, remove all style attributes and move them to a <style> region in the page head.

Second, the new page should be accessed by a URL that invokes a CGI program called cafe-2.php or cafe-2.cgi. You may write the CGI program in PHP (preferably) or any other language, including C, C++, Perl, Python, or Java. (Check with us if you want to use a language not listed here.) You may use language-specific libraries to help you parse parameters and generate HTML code, preferably using a template scheme. Invoking the CGI program as a URL without parameters should produce a page that looks like the screenshot at at http://www.cs.uky.edu/~raphael/courses/CS316/project2/asg.cafe-2.1.png.

As you see, the cafe's web page has gotten some new features and dropped some old ones. The text of each menu item can now be clicked, bringing up a similar page but with the menu information shown, as in the screenshot at http://www.cs.uky.edu/~raphael/courses/CS316/project2/asg.cafe-2.2.png. Here are the menu items, descriptions, and prices.

snacks
	olive hash	mashed olives in gravy	$2.50
	smarties	small savory bites	$1.00
	clumpers	chocolate-covered raisins	$1.50
drinks
	smoothie	peach and frog flavored	$5.54
	milk	fresh from our cow	$2.50
	water	guaranteed mostly pure	$0.50
mains
	steak	primal rib	$20.50
	fish	whatever we found at the market	$25.00
	mac-n-cheese	always a winner!	$15.00
deserts
	ice cream	durian or avocado	$5.00
	shave ice	durian or avocado	$3.20
	cake	dark forest	$4.00
for kids
	mac-n-cheese	always a winner!	$5.00
	small fry	most likely some fish	$5.00
takeout
	empty box	recyclable	$0.30
	pizza slice	vegan, white	$1.00
	ice cream cone	durian or avocado	$5.00
inedible
	beer stein	glass	$3.00
	can holder	rubber	$2.00
	napkins	50, recycled	$1.00
poisonous
	table cleaner	bottled	$10.50

There are no menu items for pets!

The CGI program uses a mySQL database with a table called menu that stores all the menu items. It has columns category, item, description, and price. The first three are of type TEXT; the last is of type DECIMAL(4,2). A second table, called accesses, has two columns: category and number, of type TEXT and SMALLINT. It stores how many times each menu item has been accessed; increase the number by 1 for each access. You need to create and populate these tables once by using mysql directly from the command line.

Method

1. As before, the HTML that your CGI program generates must be self-contained, without recourse to any external CSS stylesheets or JavaScript libraries. The web page must validate without warnings or errors.
2. You must not use style= attributes; all style must be in the <style> section in the <head> region.
3. You must prevent cross-site scripting attacks. The best way is to use ? in any mySQL statement that refers to data coming from the web page, then prepare the statement, then execute it providing the actual values, like this:

   $sql = "SELECT price FROM menu WHERE category = ?;
   $prepared = $pdo->prepare($sql);
   $prepared->execute([$valueFromHTMLform]);
   

4. If an invalid menu item is presented to your CGI script, treat it as if the CGI program receives no parameter at all. Use the accesses table as the source of valid menu items.
5. If you are using PHP, you do not need to use PHP classes; all the code may be in the main program. In any case, your CGI program should be well-written.
6. You already have a database in your mysql account with your name (like abcd123).
7. You can connect to your database directly from the MultiLab using mySQL and executing commands like the following (changing abcd123 to your login name):

   % mysql -h mysql.cs.uky.edu -D abcd123 -u abcd123 -p
    	[it will prompt for your password, initially 'u'+last 7 digits of your UKID]
   DESCRIBE menu;
   SELECT * FROM menu;
   QUIT;
   

8. You may refer to online resources and books, but you must not share your work with others.

Extra credit ideas

If you do any extra credit, you must indicate that in your documentation if you want credit.

1. Introduce a primary key in the tables to make searching more efficient.
2. Introduce a constraint that forces the entries in the accesses table to correspond to entries in the menu table.
3. Use AUTO_INCREMENT instead of arithmetic to modify the number value in the accesses table.
4. Add a start fresh button that resets the counts of accesses to 0.
5. Provide a way for managers to use the CGI program to modify the prices. You need to introduce some form of security so customers cannot modify the prices.

Turn in

Turn in your CGI program via Canvas. If you are using a template scheme that requires a separate file, include both your CGI program and the template file and submit as a ZIP file. Keep your personal mysql credentials in a separate file that your CGI program refers to, but do not submit that credentials file.