DaDaBIK Documentation
General information
Project name: DaDaBIK (DaDaBIK is a DataBase Interfaces
Kreator)
Author: Eugenio Tacchini (eugenio at favoriti dot it)
Web site: http://www.dadabik.org/
Last release: 4.3 (released December 8, 2010). This
documentation is about the 4.3 release, if you need the
documentation for a previous release please read the documentation file
included in each downloaded package.
License: DaDaBIK is released under the GPL license V. 2.
Table of contents
What is DaDaBIK?
Requirements
Installation
Upgrade from previous versions
Configuration
Authentication
Multiple function views: creating two instances of
DaDaBIK
Security
Coding guidelines
FAQs
Known bugs and limitations
DaDaBIK is a very popular and mature Open Source PHP
application which allows you to easily create a
highly customizable database front-end/application without coding. You
can use it to create in a few minutes a very basic CRUD (create, read,
update, delete) database front-end or to develop a more sophisticated
database application.
No programming skills are needed to use it; if however you are a PHP
programmer with DaDaBIK you can save tens of hours of work.
With DaDaBIK (differently from many competitors) you don't produce a
PHP script, which would become outdated when you modify the schema of
your database, but instead you directly use its abstraction layer that
can be easily updated every time you modify your database's schema.
DaDaBIK uses the ADOdb
Database Abstraction Library in order to support as many DBMSs as
possible, at the moment it has been tested on MySQL, PostgreSQL, Oracle
and MS SQL Server.
The strength of DaDaBIK lies in its ability to be customized. For
example for each table field you can choose:
- if the field must be included or not in a search/insert/update
form and results table
- its label
- its content format (e.g. numeric, alphabetic, e-mail,
url...)
- the HTML input type (e.g. textbox, menu, date, rich text editor,
password box...)
- the possible values, also driven from another table (foreign key
support)
- and more...
Other features include file uploading, master/details view, export
to CSV, checking
for possible duplication during an insert, authentication and
authorization restrictions on view/update/delete, e-mail notices.
The graphic layout of DaDaBIK is customizable to help you to embed
it in your own site.
DaDaBIK differs from PHPMyAdmin: it has not been created to offer
the complete administration of a database, but rather to allow the
creation of a customizable and user friendly database application. The
target of a DaDaBIK application can be the final user instead of a DB
administrator.
DaDaBIK is available in Italian, English, Dutch, German, Spanish,
French, Portuguese, Croatian, Polish, Catalan, Estonian, Rumanian,
Hungarian, Swedish, Slovak and Finnish.
Since its first release in 2001 it has been downloaded more than
150.000 times and its users community has produced about 10.000 posts
in the forums.
[back to top]
Requirements
- PHP
- version >= 4.3
- magic_quotes_sybase = on in php.ini if you use DaDaBIK with
Microsoft
SQL server or Oracle (for MySQL and PostgreSQL the default
magic_quotes_sybase = off is ok)
- PHP upload enabled if you want to use the upload feature
(see PHP manual for php.ini and file permissions settings)
- MySQL
- version >= 3.23.x (probably also works with previous
releases)
- PostgreSQL
- Only tested with 8.x version, probably works with 7.x and 9.x
versions
too
- Oracle
- MS SQL Server
- Only tested with 2000 version, probably works with other
versions too
- A pre-existent database with AT LEAST ONE table to manage,
with DaDaBIK you can't create databases and tables,
[back to top]
Installation
- Copy everything which is contained in the directory program_files
in a directory under your Web server
- Open the file /include/config.php with a text editor and
edit it (specify at least $dbms_type, $host, $db_name, $user, $pass,
$site_url, $site_path)
- Run the file http://your_host/your_dir/install.php to
install DaDaBIK
- Open the file http://your_host/your_dir/index.php in
your
browser and have fun!! You can now start using DaDaBIK.
You can now insert, search, update, delete the records of the tables
contained in the database $db_name. You
should have set a primary key for each table managed with DaDaBIK if
you want to delete and update records, otherwise
DaDaBIK won't show you the corresponding buttons.
Also the "search similar record" feature during the insert needs a
primary key.
The "insert e-mail notice" feature needs a primary key auto increment
field to work.
Please leave the link
Powered by: DaDaBIK database
front-end
somewhere if you use DaDaBIK; it isn't compulsory but I would really
appreciate it.
[back to top]
Upgrade from previous versions
If you want to upgrade from 4.3 rc2 to 4.3
without loosing your configuration you don't need to re-install
DaDaBIK:
- Replace all the old files with the new ones (keep your upload
folder if you want to save the uploaded files )
- Update your /include/config.php file using your old
configuration settings
- Run the file http://your_host/your_dir/upgrade_4.3_final.php included in the 4.3 final release to upgrade DaDaBIK from 4.3 rc2 to 4.3
If you want to upgrade to 4.3 from a release older than 4.3 rc2 you should first upgrade to 4.3 rc2, read the related documentation to know how to do it.
[back to top]
Configuration
Introduction
The configuration of DaDaBIK can be managed at two different levels:
- Some general configuration parameters can be set from the file /include/config.php,
just by opening it with a plain text editor and editing it. The file is
self-explanatory. At this level you can, for example, set the database
you want to manage with DaDaBIK, or enable/disable some DaDaBIK features
- For a more analytic tuning you are supposed to use the
administration section http://your_host/your_dir/admin.php. At
this level you can choose the table you want to include/exclude and,
for each table, create your own DaDaBIK interface, choosing for example
the field you want to include/exclude from the forms, the content of
each field, the labels....
Also the administration section is self-explanatory, so in the
following paragraph we will explain in detail only the interface
configurator, which is the core of the DaDaBIK configuration; you
can reach it from the home page of the administration section.
The graphic customization can be done by changing the files /include/header.php
and /include/footer.php and by using the CSS files /css/styles_screen.css
and /css/styles_print.css, the former is the main one, the
latter is used only when you print a page produced by DaDaBIK.
From the files under /include/languages you can customize all
the sentences DaDaBIK uses.
Interface configurator
Here is the meaning of all the parameters you can set for each table
field:
- Label: the text that DaDaBIK will display in the interface
as label of the field
- Field type, select among:
- text: a text box
- textarea: a textarea box
- rich_editor: a rich text editor that allows to easily
insert/modify HTML content. This could lead
to the same security problems that can affect the html content type,
see later for details.
- password: a password text box
- insert_date: the current date will be automatically
inserted into this field when you insert a new record in your table;
an insert_date field must be excluded from the insert/update form,
see below (Field present in the insert/update form?). Note that the
corresponding database field type must be date
- update_date:
the current date will be automatically
inserted into this field when you update a record in your table; an
update_date field must be excluded from the insert/update form, see
below (Field present in the insert/update form?). Note that the
corresponding database field type must be date
- date: three menu: day, month, year. Note that the
corresponding database field type must be date
- select_single: a customizable menu, see below the
parameters Option to include, Primary key field, Primary key table,
Linked fields to specify the menu items
- generic_file: an input field which allows the user to
browse in his file system and upload a file. You need to specify the
allowed file extensions in config.php. Note that the corresponding
database field type must be varchar.
- image_file: the same as the above, but in this case
DaDaBIK supposes that the file is an image and shows it when the record
is displayed. You need to specify the allowed file extensions in
config.php. Note that the corresponding database field type must be
varchar
- ID_user: the username of the current user will be
automatically inserted into this field when you insert a new record;
an ID_user field must be excluded from the insert/update form, see
below (Field present in the insert/update form?). Note that the
corresponding database field type must be varchar.
- unique_ID:
a unique ID generated by using the PHP
function unique_ID() in conjunction with microtime(), getmypid() and
md5() will be automatically inserted in this field when you insert a
new record into your table; a unique_ID field must be excluded from the
insert/update form, see below (Field present in the insert/update
form?). Problably you will never use this field type, it can be useful
just in very special cases.
- Content type: the content typep determines the check
procedure DaDaBIK will use during an insert/update and how a field
value is displayed; select among:
- alphabetic: only alphabetic characters allowed
- alphanumeric: all characters allowed
- numeric: only numeric characters allowed
- url: only URL with a correct syntax allowed, support
from http/https/ftp protocols and port numbers; field displayed as a
URL link
- email: only e-mail
- html: all characters allowed; DaDaBIK doesn't perform
a conversion from special characters to HTML entities with
htmlspecialchars for the fields having this content type. For example,
this content type can be used to enter a full custom URL in the
standard HTML format or an HTML formatted text. WARNING:
This can lead to
security risks; DaDaBIK uses the popular htmLawed
library to prevent displaying of dangerous HTML/Javascript code but, as
the authors state, (http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s2.8),
there are some minor cases in which htmLawed can fail. If a malicious
user insert some arbitrary javascript code and the library fails in
recognizing it, the code can be then executed by other users just by
using the application. Among other problems, this can lead to XSS
attack (http://en.wikipedia.org/wiki/Cross-site_scripting),
which in turn can allow an unauthorized access to the application (http://en.wikipedia.org/wiki/Session_hijacking)
and, if the Internet browser of the user contains security holes, even
the execution of arbitrary code in the client machine. Use at your own
risk.
- phone: only phone numbers with a correct syntax (a +
sign followed by numbers e.g. +39025689781) allowed
- The following parameters are used to choose if a field must
be displayed and used in the various sections of DaDaBIK: Field
present in the search form?/Field present in the results page?/Field
present in the details page?/Field present in the insert/update form?
For the last one (insert/update form), if the field is auto-increment
you should choose N.
- Is the field a required one? Choose if the field should
be required during insert and update procedures
- Check for duplicated entries during insert? Choose if
the field value should be checked for possible duplication during the
insert procedure
- Other choices allowed? Choose if the field, a
select_single one, can accept also values other than the pre-set
options during an insert/update.
If the user add a different value, it will be included in the list of
pre-set options. Note that, if the field is a foreign key (see Primary
key field for a definition), the other value is used to insert
a new record in the primary key table.
The use of this option together with a foreign key field makes sense
only if there is just one linked field and requires that Primary
key table has a primary key auto-increment field.
- Option to include: specify the possible options of a
select_single field e.g. ~~teacher~manager~student~, in this example
the first option is blank.
- Primary key field: if a field is a select_single and the
options must be driven from another table (so the field can be
considered foreign key for DaDaBIK, regardless of a real dbms foreign
key declaration), specify here the primary key of that table.
- Primary key table: if a field is a select_single and the
options must be driven from another table, specify here the name of
that table.
- Linked fields: the fields in the primary key table you
want to display. Imagine you have a table albums_tab that
contains information about CDs. In this table you have a field ID_author
that "links" the table authors_tab. If you want to display, for
each record, first_name_author and last_name_author of authors_tab,
you have to use ID_author as primary key field, authors_tab
as primary key table, first_name_author~last_name_author
as linked fields
- Order by: the linked field by which you want to order the
items in the menu created by a select_single field
- Order type: the order type (ASC or DESC, if you leave
blank ASC is the default) to be used on the "Order by" field
- Search operator: specify is_equal, contains, starts_with,
ends_with, greater_than, less_than or a group of this operator
separated by "/". E.g. if you specify just "contains" DaDaBIK will use
always the contains operator for this field during the search; if you
use "exactly/contains" DaDaBIK will create for this field a listbox
with the operators exactly/like, the user can then choose the preferred
one during each search operation
- Prefix: for text, textarea and rich_editor fields you can
choose a prefix default value for your field, e.g. "http://" if your
field need to be filled with a Web url; the prefix will be displayed
directly in the insert form, but if the user doesn't fill-in the field
it will be considered as blank
- Default value: for text, textarea and rich_editor fields
you can choose a default value for your field, the value will be
displayed directly in the insert form
- Width: the width of an input box, used with text,
password, textarea and rich_editor boxes
- Height: the height of an input box, used with textarea and
rich_editor boxes
- Maxlength: the maximum number of characters allowed in the
input box, used with text, password, textarea, rich_editor boxes and
select_single (just for the "other" option)
- Hint: the text of a hint for the user that will appear
during the insert/update procedure near the input field
- Linked items table names: you should fill this property
only for the primary key of a table, when you want to enable a
master/details view.
For example imagine you have an albums (id_album, title_album) table
and a songs (id_song, id_album, title_song) table; if you want to
display, in the album detail view, also the list of the linked songs,
you have to put songs in Linked items table names and id_album
in Items table foreign key field names (see below). Each table
can have more than one linked table; in this case you can add
additional table and foreign key field names using the separator
- Items table foreign key
field names: you should fill this property only for the primary key
of a table, when you want to enable a master/details view.
For example imagine you have an albums (id_album, title_album) table
and a songs (id_song, id_album, title_song) table; if you want to
display, in the album detail view, also the list of the linked songs,
you have to put songs in Linked items table names (see
above) and id_album in Items table foreign key field names.
Each table can have more than one linked table; in this case you can
add additional table and foreign key field names using the separator
- Separator: This is the separator characther used here to
separate values in the Option to include, Linked fields,
Linked items table names and Items table foreign key
field names parameters. In most of the case you can safely leave
(and use) the default one, ~
[back to top]
Authentication
An authorization model is available to prevent unauthorized accesses
and to allow users to:
- Delete only their own records
- Modify only their own records
- View only their own records
The owner of a record is the user who entered it.
To enable authentication, each table you want to protect must have a
field whose field type is set to ID_user; you also have to set
$enable_authentication = 1 in /include/config.php. By setting
the parameters $enable_delete_authorization, $enable update
authorization and $enable_browse_authorization you can then customize
your authorization model.
There are two types of users: normal users and administrator users.
Administrator users can view and manage users list by using DaDaBIK
itself.
DaDaBIK is released with the following default administrator user:
- username: root
- password: letizia
It is strongly recommended to change the default root password for
security reasons.
DaDaBIK uses by default the table users_tab to store user information,
but you can also use your own users table, changing the $users_table_*
parameters in /include/config.php.
User passwords need to be md5 encrypted before being
registered/updated, so before inserting a new user or changing the
password for an existing one it is necessary to create the encrypted
password by following the "md5 crypter" link in the users form.
[back to top]
Multiple function views: creating two
instances of DaDaBIK
Sometimes it is necessary to have one view for users where they can
only
view the data and a second view for the database administrators to
manage
the data being displayed. This will help you set up two instances of
DaDaBIK to look at the same database.
- Install your first instance of DaDaBIK using the default DaDaBIK
table
prefixes contained in the /include/config.php file (last two
variables in the
file).
http://your_host/your_dir/install.php
If you want things to look the same in both installations like
headers,
footers, logos, etc., you can make those changes now so that you only
have
to make them once; otherwise you can worry about prettying it up later.
- Copy your entire DaDaBIK folder into a new folder you wish to use
for
the second instance: http://your_host/your_dir/ <-- all
contents copied to: http://your_host/your_dir/admin-dir-name/
- Open /include/config.php from the /your_dir/admin-dir-name/include/
folder and
change the table prefix and table list name in this file to something
like:
dadabik_admin_
and
dadabik_admin_table_list
It does not matter what your prefixes are -- just so long as
they are
different from the first install prefixes.
Also in /include/config.php, change the $site_url to the
correct URL for the admin area so the correct installation is used.
- Now, install your second instance of DaDaBIK:
http://your_host/your_dir/admin-dir-name/install.php
- This will create additional tables with your admin prefix for all
your
original DaDaBIK tables also. You should remove them by going to the
admin
interface for the second instance you just installed and uninstall
those
tables.
For this example, we'll assume you used the following:
1st install: "dadabik_" table prefix with
"dadabik_table_list" table list name
2nd install: "dadabik_admin_" table prefix with
"dadabik_admin_table_list" table list name
In the admin for the 2nd install (http://your_host/your_dir/admin-dir-name/admin.php),
"uninstall" each table you see beginning with
"dadabik_".
- Now you can manage both instances independent from each other
through:
http://your_host/your_dir/admin.php
and
http://your_host/your_dir/admin-dir-name/admin.php
Once you have two (or more) instances created, you can apply
security to
each one separately. Refer to the Authentication and Security sections
for more information.
[back to top]
Security
After the program is installed it is a good practice to remove the
file
install.php and all the upgrade*.php files since they could be used by
malicious users in order to change or even re-install your DaDaBIK
installation.
The files admin.php and internal_table_manager.php could also be used
to modify your installation. If you enable the
authentication within DaDaBIK, access to the files will be protected,
otherwise other methods of protecting these files may be required.
Read carefully this documentation file (see above, configuration
section) before using the HTML content type and the rich_editor field
type, which can lead to high
secrutity risks
[back to top]
Coding guidelines
If you want to contribute to the DaDaBIK code you have to follow
some
coding guidelines; this document: http://www.evolt.org/article/PHP_coding_guidelines/18/60247/
fits most of DaDaBIK coding style rules, in particular follow the
sections:
- Tabs v. spaces
- Variable names
- Loop indices
- Function names
- Function arguments
- Including braces
- SQL code layout
- Quoting strings
- Shortcut operators
- Turn on all error reporting
In addition and/or modification to the above document sections, here
are other rules:
- The first brace must be put on the first
line of the block.
Examples:
if (isset($username_user)){ is ok
if (isset($username_user))
{ is wrong
- if, else, while , for....closing brace must be followed by
a // end if, // end else, // end while, // end for.....comment.
Examples:
if (isset($username_user)){
echo 'Username set';
} // end if
else {
echo 'Username not set';
} // end else
- Array name must be plural and terminate with the _ar suffix.
Examples:
$users_ar is ok
$user, $users, $user_ar are wrong
- Global variables must not be used, functions must receive
as parameters all the variables they need. Exceptions are made for:
$conn, $quote, $current_user, $current_user_is_administrator,
$submit_buttons_ar, $normal_messages_ar and all configuration variables
(the ones set in /include/config.php)
- $_GET variables are not used directly; corresponding
variables are set in index.php.
Examples:
if (isset($_GET["page"])){
$page = $_GET["page"];
} // end if
After the above setting, the $page variable is used in the code.
Other coding rules should be learned looking for the DaDaBIK code.
Please contact me if you have any doubts.
[back to top]
FAQs
I am looking for an old version of DaDaBIK, can anybody help me
with a link to DaDaBIK x.x ??
Old releases of DaDaBik can be found at sourceforge.
but you are strongly encouraged not to use old releases, which can
have security problems
I get:
"[06] Error: during database connection.
MySQL server said: Client does not support authentication protocol
requested by server; consider upgrading MySQL client".
Why?
It is due to the authentication protocol introduced with MySQL
4.1.x; here:
http://dev.mysql.com/doc/mysql/en/old-client.html
you can find several solutions.
I get [08] Error Message
I get "Error during query execution"
Please open the file include/config.php, look for the variable
named $debug_mode. Set it to 1, so that you'll be able to see
what the error is. If you still cannot figure it out post the
error message in the support forum.
I can't see the edit/delete record icons in the results view
You did not set a primary key in the table, so you are able to see the
records but DaDaBIK cannot edit/delete them.
I get "your database is empty" error, why?
You first have to set up a database and then you can install DaDaBIK.
Are multiple primary keys supported?
Not yet. Not planned. If you're interested in developing it please
contact me (eugenio at favoriti dot it).
Page not showing after Insert/Update.
Open include/config.php and make sure the variable
$site_url is set to the the complete path to your DaDaBIK installation.
(E.g http://www.yoursite.com/dadabik_folder/)
How to change graphic layout etc?
The role of the files is self-explicatory
include/header.php
include/footer.php
This takes care of the general styles
css/style.css
These two functions take care of forms and results table styles
change build_form() and build_results_table()
[back to top]
Known bugs and limitations
- Security related:
- Malicious users could use PHP scripts for setting session
variables to particular values in order to bypass the login procedure
and get unauthorized access to DaDaBIK. These scripts must be hosted on
the same domain where the DaDaBIK target installation is hosted.
- Malicious users can exploit a field with content type set to
HTML
or field type set to rich_edit to insert arbitrary javascript code,
this can lead to security risks if the htmLawed library doesn't filter
this content properly (see above, configuration section, for all the
details).
- Table and field names related:
- Insert/search/update fail if one or more field names contain
blank spaces or dots (e.g. "my field" or "my.field" are not allowed,
use "my_field" instead).
- Quote characters, such as ' ` ", could lead to problems if used
in table and field names.
- Using field names containing the value set for $alias_prefix,
$null_checkbox_prefix, $select_type_select_suffix, $year_field_suffix,
$month_field_suffix, $day_field_suffix could lead to unexpected
results; you can change the value of the above variables editing
/include/config.php
- User interface related:
- Estonian, Polish, Croatian, Spanish and Slovak languages are
not
completed.
- The rich editor interface (TinyMCE) is displayed in english
only.
- PosgreSQL and Oracle related::
- DaDaBIK needs table names in lower case to work on PostgreSQL.
- DaDaBIK doesn't work correctly on Oracle if table and/or field
names are in mixed case.
- The sql logging feature doesn't work on Oracle and produces an
"LOGSQL Insert Failed" message.
- The insert e-mail notice doesn't work on PostgreSQL and Oracle.
- Insert/update don't work correctly on PostgreSQL and Oracle if
the user choose "Other...." from a select_single field menu and the
field has some linked fields.
- Admin section related:
- The field renaming feature of the administration page doesn't
work as expected if the renamed field is used in one of the following
properties: "Primary key field", "Linked fields", "Order by" in the
interface configurator related to any of the tables. In particular,
after the renaming, you will get "[08] Error: during query execution"
messages from the DaDaBIK front end; you should edit the above
properties by hand, renaming the field in the interface configurator.
- The "refresh installation" admin operation doesn't work
correctly
and could lead to an interface configurator settings loss if the
installation is the result of an upgrade from a DaDaBIK version <
4.1 rc2; the "refresh installation" bug is considered fixed only for
tables installed (DaDaBIK installation from scratch or single table
installation from the admin interface) using a DaDaBIK version >=
4.1 rc2.
- Master/details related:
- In a master/details view, the details table is correctly showed
below the corresponding master table record when the edit function is
used, but it is not showed when the details function is used
- After having accessed (in edit mode) a record with
master/details view, DaDaBIK will show only the records related to that
master record if the details table is accessed in "last search results"
mode. A "show all" is needed to remove the incorrect filter.
- Others:
- The "previous" and "next" buttons don't work correctly after
this
sequence of operations:
- perform a search based on a field A
- change the value the field A for a record of the resultset
- DaDaBIK rely on the system's (server) timezone settings for
date
function (e.g. to produce the current date), which can be different
from the client's one. This is not a real bug, but it is important to
be aware of.
- Primary keys composed by multiple columns are not handled.
- The "check for duplicated" doesn't work with file types:
DaDaBIK
doesn't warn about similarity when two files have a similar name;
furthermore, the "check for duplicated" feature causes uploads to fail
during insert, in particular the files are not uploaded if some
possible duplicated records are found and the user decides to insert it
anyway.
- HTML content is not set correctly as "Default value" (interface
configurator).
- When
a new option of a select_single field with linked fields
is
inserted through the "other..." option, the current user is not
inserted in the ID_user field of the
linked table. This means that the new record in the linked table won't
get an owner and the $enable_delete_authorization,
$enable_update_authorization and $enable_browse_authorization options
won't work as expected.
[back to top]