Skip to content
CampusPrep
CY-603 (B) · Applied Cryptography/Quick Revision Short Notes

Applied Cryptography (CY-603 (B)) - Unit 1 Short Notes

UNIT 1: FOUNDATIONS OF WEB TECHNOLOGIES & SERVER-SIDE PROGRAMMING

1.0 Introduction to Web Technologies & Core Protocols

1.1 HyperText Transfer Protocol (HTTP)

  • Definition: HTTP is an application-layer protocol for transmitting hypermedia documents (like HTML) across the World Wide Web. It follows a stateless, request-response model.

  • Utility & Purpose: It is the foundation of data communication for the web, enabling clients (browsers) to request resources (pages, images) from servers and for servers to deliver those resources.

  • HTTP Methods (Verbs): Define the action to be performed on a resource.

    | Method | Purpose & Idempotence | Common Use Case | | :--- | :--- | :--- | | GET | Safe & Idempotent. Retrieves data. Should not modify server state. | Fetching a webpage, search queries. | | POST | Non-idempotent. Submits data to be processed, often causing a change in state. | Form submissions (login, comments), uploading files. | | PUT | Idempotent. Replaces a target resource with the request data. | Updating a complete user profile. | | DELETE | Idempotent. Removes the specified resource. | Deleting a blog post or account. | | HEAD | Same as GET but retrieves only headers (no body). | Checking if a resource exists, getting metadata. |

[!TIP] Exam Focus: Distinguish idempotent methods (GET, PUT, DELETE - multiple identical requests have same effect as one) from non-idempotent (POST). GET parameters are in the URL; POST data is in the request body.

1.2 Web Design Issues

Key considerations for effective, user-centric websites:

  • Usability: Intuitive navigation, clear calls-to-action, minimal learning curve.

  • Accessibility (a11y): Designing for users with disabilities (e.g., semantic HTML, ARIA labels, keyboard navigation, sufficient color contrast).

  • Responsiveness: Layouts that adapt seamlessly to different screen sizes/devices (mobile-first approach, fluid grids, media queries).

  • Performance: Optimizing page load speed (minified assets, compressed images, efficient code).

  • Cross-Browser Compatibility: Ensuring consistent functionality and appearance across different browsers (Chrome, Firefox, Safari, Edge).

  • Search Engine Optimization (SEO): Using proper markup, keywords, and structure to improve search ranking.

2.0 Markup Languages: Structure and Semantics

2.1 HyperText Markup Language (HTML)

  • Page Layout: Uses semantic elements (<header>, <nav>, <main>, <section>, <article>, <aside>, <footer>) to define document structure meaningfully, improving accessibility and SEO. Layout techniques include CSS-based layouts (Flexbox, Grid) over deprecated tables.

  • Linking:

    • Hyperlinks: Created with the <a href="URL">anchor text</a> tag.

    • Internal Links: Links to a section within the same page using href="#id".

    • External Links: Links to a different page or website using a full URL.

  • Lists:

    • Ordered List (<ol>): Numbered list. <li> for list items.

    • Unordered List (<ul>): Bulleted list. <li> for list items.

    • Definition List (<dl>): List of terms and definitions. Uses <dt> (term) and <dd> (definition).

    
<ul>

    <li>Coffee</li>

    <li>Tea</li>

    <li>Milk</li>

</ul>

  • Forms (<form> element): Used to collect user input.

    • Text Inputs: <input type="text">, <input type="password"> (masked).

    • Radio Buttons (<input type="radio">): Mutually exclusive options within a group (same name attribute). Only one can be selected.

    • Check Boxes (<input type="checkbox">): Allows multiple independent selections.

    • Select/Dropdown: <select> with nested <option> tags.

    • Textarea: <textarea> for multi-line text.

    • Buttons: <input type="submit">, <input type="reset">, <button>.

2.2 Extensible HyperText Markup Language (XHTML)

  • Comparison with HTML: XHTML is HTML reformulated as an XML application. Key differences:

    | Feature | HTML | XHTML | | :--- | :--- | :--- | | Syntax Strictness | Looser, more forgiving. | Strict. Must be well-formed XML. | | Case Sensitivity | Tag/attribute names are case-insensitive. | Case-sensitive (must be lowercase). | | Closing Tags | Some tags (e.g., <br>) are optional. | All tags must be closed (<br />, <img ... />). | | Attribute Values | Values can be unquoted. | Attribute values must be quoted (name="value"). | | Nesting | Some improper nesting is tolerated. | Elements must be properly nested. |

3.0 Presentation and Styling

3.1 Cascading Style Sheets (CSS)

  • Definition & Purpose: A style sheet language used to describe the presentation (layout, colors, fonts) of a document written in HTML or XML. It separates content (HTML) from presentation (CSS).

  • Advantages:

    • Maintainability: Change styles in one place (external CSS) affects all linked pages.

    • Consistency: Ensures uniform look and feel across the entire site.

    • Accessibility: Allows users to override styles with custom CSS.

    • Bandwidth Savings: External CSS files are cached by the browser, reducing page size.

    • Device-Specific Styling: Enables responsive design via media queries.

  • Basic Syntax: selector { property: value; }

  • Common Selectors: Element (p), Class (.class), ID (#id), Universal (*), Attribute ([type="text"]).

4.0 Client-Side Scripting and the DOM

4.1 JavaScript Fundamentals

  • Role: Adds interactivity and dynamic behavior to web pages. Runs in the browser's engine.

  • Form Objects: Radio Buttons & Check Boxes (Manipulation)

    • Access: Via document.forms['formName'].elements['elementName'] or document.getElementById('id').

    • Key Property: .checked (Boolean: true if selected).

    • Key Events: onclick, onchange.

    • Example: Validating that at least one checkbox is checked before form submission.

    
if (document.getElementById('agree').checked) {

    // Proceed

}
4.2 Document Object Model (DOM)

  • Concept: A platform- and language-neutral interface that treats an HTML/XML document as a tree structure of nodes (elements, attributes, text).

  • Tree Structure: The entire document is a Document node. HTML tags are Element nodes, text inside tags are Text nodes.

    
Document

├── html (Element)

│   ├── head (Element)

│   └── body (Element)

│       ├── h1 (Element) -> "Hello" (Text)

│       └── p (Element) -> "World" (Text)

  • Core Methods:

    • Accessing: getElementById(), getElementsByClassName(), getElementsByTagName(), querySelector().

    • Modifying: innerHTML, textContent, setAttribute(), createElement(), appendChild().

5.0 Data Representation and Transformation

5.1 Extensible Markup Language (XML)

  • Definition & Purpose: A meta-language for defining custom markup languages. Used for structured data storage, configuration, and platform-independent data exchange (e.g., RSS feeds, SOAP, configuration files).

  • Key Attributes/Features:

    • Well-formedness: XML document must follow basic syntax rules (single root element, proper nesting, quoted attributes, case-sensitive tags).

    • Validity: Document must conform to a defined structure (schema) via DTD (Document Type Definition) or XSD (XML Schema Definition).

    • Extensibility: Users can define their own tags and document structures.

    • Self-describing Data: Tags provide meaning to the data they enclose.

5.2 Extensible Stylesheet Language Transformations (XSLT)

  • Definition & Primary Use Case: An XML-based language used to transform an XML document into another format (most commonly HTML, but also text or another XML structure).

  • Core Concepts:

    • XSLT Stylesheet: An XML document containing templates (<xsl:template match="...">) that define how to transform matched nodes.

    • XPath: A language used within XSLT to navigate and select nodes in the source XML document (e.g., /bookstore/book/title).

    • Transformation Process: An XSLT processor applies the templates to the source XML, producing a result tree (output).

6.0 Server-Side Programming with PHP

6.1 PHP Fundamentals & Control Structures

  • Loop Statements:

    • for ($$\displaystyle i = 0; $$i < 10; $i++) { ... } – Known iteration count.

    • while ($condition) { ... } – Pre-test loop (checks condition first).

    • do { ... } while ($condition); – Post-test loop (executes at least once).

    • foreach ($array as $value) { ... } – Iterates over arrays/objects easily.

6.2 Object-Oriented Programming (OOP) in PHP

  • Core Concepts:

    • Class: Blueprint/template (class Car { ... }).

    • Object: Instance of a class ($myCar = new Car();).

    • Property: Variable inside a class (public $color;).

    • Method: Function inside a class (public function drive() { ... }).

    • Constructor (__construct()): Special method called when an object is created.

    • Destructor (__destruct()): Special method called when an object is destroyed.

    • Inheritance: A class (Child) can extend another (Parent) to inherit properties/methods (class Child extends Parent).

    • Access Modifiers: public (accessible everywhere), private (only within class), protected (within class & subclasses).

6.3 File Handling in PHP

  • What is a File? A named, persistent collection of data stored on a storage device (disk).

  • Basic Process & Functions:

    1. Open/Create: $handle = fopen("file.txt", "mode"); (Modes: r, w, a, x).

    2. Read: fread($handle, length); or file_get_contents("file.txt");.

    3. Write: fwrite($handle, "data"); or file_put_contents("file.txt", "data");.

    4. Close: fclose($handle);.

    [!TIP] Always check if fopen() succeeds and close files with fclose() to free system resources.

6.4 PHP & MySQL Database Connectivity

  • Connectivity String (using mysqli procedural):

    
$conn = mysqli_connect("localhost", "username", "password", "database_name");

if (!$conn) { die("Connection failed: " . mysqli_connect_error()); }

    Using PDO (recommended for flexibility):

    
try {

    $conn = new PDO("mysql:host=localhost;dbname=database_name", "username", "password");

    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

} catch(PDOException $e) { echo "Connection failed: " . $e->getMessage(); }

  • Table Creation Program (using mysqli):

    
<?php

$servername = "localhost";

$username = "root";

$password = "";

$dbname = "testDB";

// Create connection

$$\displaystyle conn = mysqli_connect( $$servername, $username, $password, $dbname);

// Check connection

if (!$conn) {

    die("Connection failed: " . mysqli_connect_error());

}

// SQL to create table

$sql = "CREATE TABLE Users (

id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY,

firstname VARCHAR(30) NOT NULL,

lastname VARCHAR(30) NOT NULL,

email VARCHAR(50),

reg_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP

)";

if (mysqli_query($conn, $sql)) {

    echo "Table Users created successfully";

} else {

    echo "Error creating table: " . mysqli_error($conn);

}

mysqli_close($conn);

?>
6.5 State Management: Sessions vs. Cookies

  • Differentiation:

    | Feature | Session | Cookie | | :--- | :--- | :--- | | Storage Location | Server (file or database). Only session ID stored on client. | Client's browser (text file). | | Security | More secure. Data not exposed to client. | Less secure. Data visible/editable by user, vulnerable to theft. | | Lifetime | Ends when browser is closed or after server-defined timeout. | Persists based on expires attribute (can be years). | | Data Limit | Large amount of data (limited by server resources). | Small (~4KB per domain). | | Usage | Sensitive user data (login status, user ID, cart items). | Non-sensitive preferences (theme, language), tracking. | | PHP Functions | session_start(), $$\displaystyle _SESSION['key']`, `session_destroy()`. | `setcookie()`, ` $$_COOKIE['key']. |

7.0 Advanced Topics & Data Integrity

7.1 Database Bugs (SQL Injection)

  • Concept: A code injection technique where an attacker inserts malicious SQL statements into an application's input fields, which are then executed by the database.

  • How it Occurs: When user input is concatenated directly into an SQL query string without proper sanitization or parameterization.

    
// UNSAFE CODE (Vulnerable)

$$\displaystyle sql = "SELECT * FROM users WHERE username = '" . $$_POST['user'] . "' AND password = '" . $_POST['pass'] . "'";

// If user enters: ' OR '1'='1 in username field, query becomes always true.

  • Mitigation Strategies:

    1. Prepared Statements (Parameterized Queries): BEST PRACTICE. Separate SQL logic from data.

      
// Using mysqli

$$\displaystyle stmt = $$conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");

$$\displaystyle stmt->bind_param("ss", $$user, $pass); // "ss" = two strings

$stmt->execute();

    2. Input Validation/Sanitization: Validate type, length, format (e.g., filter_var()). Use mysqli_real_escape_string() as a secondary measure, not primary.

    3. Principle of Least Privilege: Database user for the app should have only necessary permissions (not DROP, GRANT).

    4. Error Handling: Do not display raw database errors to users (use custom error pages).

[!TIP] SQL Injection is a top web vulnerability (OWASP Top 10). Always assume user input is malicious. Prepared statements are non-negotiable for security.

Go to where you left off?

Quick Add to Notes

Save questions, your own notes and screenshots into notes filed by unit. It takes a free account.

Create free account

Have an account? Log in