Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 390c3a0

Browse files
unmeshvrijeunmeshvrije
authored
Merge pull request HackYourFuture#200 from HackYourFuture/unmesh
week 3 content and homework
2 parents 1268577 + 55701a1 commit 390c3a0

File tree

8 files changed

+172
-107
lines changed

8 files changed

+172
-107
lines changed

‎README.md

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
### About
66

7-
This three-week program aims to introduce the fundamental concepts of data entities and data storage.
7+
This three-week program aims to introduce the fundamental concepts of databases using MySQL.
88

99
### Key Objectives
1010

@@ -15,34 +15,35 @@ By the end of this module, students should have a familiarity with and basic und
1515
- The Structured Query Language (SQL)
1616
- The construction of a database system
1717
- MySQL as an example of a relational database system
18-
- Non-relational data and NoSQL
19-
- MongoDB as an example of a NoSQL database
20-
21-
## The Practice Database
22-
23-
The login information for the student practice database will be provided during the first class. If you don't have them, send us a message - you will need the username, password, hostname, port, and database name.
2418

2519
## Lesson Plan
2620

27-
### Lesson 1: Retrieving Data
28-
29-
In this class, students will be introduced to retrieving data from a MySQL database using SELECT queries.
30-
31-
Objective: Students should be able to retrieve data from a database table using SELECT statements that include WHERE, GROUP BY, ORDER BY, LIMIT, and JOIN.
32-
33-
### Lesson 2: Practical Database Usage
21+
### Lesson 1: MySQL and Node Setup! Create, Insert and Select !
3422

35-
In this class, students will learn how to use more complex SQL queries to retrieve information across tables, and interact with data including write operations.
23+
Objective: This class aims to incorporate JavaScript code to operate the MySQL database.
24+
MySQL client can be used to demonstrate SQL queries however, students should know how to
25+
make a MySQL database connection from JavaScript, run queries from JavaScript and
26+
capture results of queries in JavaScript.
3627

37-
Objective: Students should be able to build CRUD functionality using SQL statements, including INSERT INTO, UPDATE WHERE, etc. Students will also have a basic understanding of database usage in a web application, including parameter validation, escaping, and prepared statements.
28+
### Lesson 2: Group by, Having and Joins. Promisification of JS client with prepared statements
3829

39-
### Lesson 3: Data Models, Relationships, and Schemas
30+
Objective: This class introduces more clauses (group by, having) in the
31+
select statement. MySQL joins (inner, self, left and right) should be explained
32+
with demonstration (Employee table with **reportsTo** field and Department
33+
table with its PK in Employee table is suitable for this demonstration).
34+
Promise based JavaScript program with SQL prepared statements should be
35+
understood by students. The program can be found in the Week2 folder (Credits:
36+
@remarcmij)
4037

41-
In the final week, additional theory will be covered to discuss more complex relational data. Students will learn about entity relationship modelling and how to convert these models to a database schema using normalisation and foreign-key constraints. Non-relational data will also be considered, as well as the benefits and drawbacks of relational and non-relational models.
38+
### Lesson 3: Database design, normal forms, SQL injection
4239

43-
Objective: Students should be able to create an entity relationship diagram based on a qualatative description of data requirements, and translate that into a MySQL database schema. Students should also be able to compare and contrast relational (like MySQL) and NoSQL databases (considering their benefits and drawbacks).
40+
Objective: This class invites students to discuss Entity Relationship Diagram (ERD).
41+
Students should be able to explain their choices of entities, relationships, attributes etc.
42+
SQL injection should be explained with a demonstration (with a simple JS client).
43+
Concepts of database transaction, ACID properties, normal forms should be introduced with
44+
examples / live coding (creating a transaction, committing and rollback-ing).
4445

4546
## Handing in homework
4647
Take a look at [this video](https://www.youtube.com/watch?v=-o0yomUVVpU&index=2&list=PLVYDhqbgYpYUGxRdtQdYVE5Q8h3bt6SIA) made by Daan, he explains how your homework needs to be handed in.
4748

48-
Also review the Git [workflow material](https://github.com/HackYourFuture/Git/blob/master/Lecture-3.md) from the JavaScript3 module, use this as a reference.
49+
Also review the Git [workflow material](https://github.com/HackYourFuture/Git/blob/master/Lecture-3.md) from the JavaScript3 module, use this as a reference.

‎Week1/README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Lesson 1: MySQL and Node setup! Create, Insert and Select !
22

3-
Objective : This module aims to incorporate JavaScript code to operate the MySQL database.
3+
Objective : This class aims to incorporate JavaScript code to operate the MySQL database.
44
MySQL client can be used to demonstrate SQL queries however, students should know how to
55
make a MySQL database connection from JavaScript, run queries from JavaScript and
66
capture results of queries in JavaScript.
@@ -102,11 +102,13 @@ his 24th birthday works in Facebook and lives in Redmond.
102102
CREATE TABLE table_name (column_name, column_type [, column2_name, column2_type]);
103103
```
104104

105+
#### TYPES
106+
Recall what a datatype is. js vs mysql types
107+
105108
* INT(N) type
106109
* DATE, DATETIME and TIMESTAMP, (set time_zone = '+03:00')
107110
* BLOB (LOAD_FILE(filename))
108111

109-
110112
### Fill up a table in MySQL: INSERT rows
111113
A row (aka record or tuple) represents a single, implicitly structured data item in the table.
112114

‎Week3/MAKEME.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Homework week 3
2+
3+
## Full ToDo App : Be Creative!
4+
- Design and finalize the ToDo App database. Be creative. Support multiple users.
5+
- Create a node server to make Web APIs for ToDo app
6+
- Support following functions:
7+
- Insert item(s) in ToDo list
8+
- Delete item(s) in ToDo list
9+
- Create a new ToDo list
10+
- Delete a ToDo list
11+
- Mark an item as completed
12+
- Add a reminder for the list (not for the item)
13+
- Write the necessary SQL statements/commands to maintain the state of the database.
14+
- Use PostMan to test the APIs.
15+
16+
### What to submit
17+
- .sql file with the dump of database (all create table statements, insert values etc.)
18+
- .js, .json, .\* files that make up your app/project
19+
- README.md file that explains how to run and test your app/project
20+
21+
## Check out the React repo [here](https://github.com/HackYourFuture/React)
22+
And find out how you can prepare for the first React lecture :dancers:

‎Week3/README.md

Lines changed: 80 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,96 @@
1-
# Lesson 3: Data Models, Relationships, and Schemas
1+
# Lesson 3: Database design, normal forms, SQL injection
22

3-
In the final week, additional theory will be covered to discuss more complex relational data. Students will learn about entity relationship modelling and how to convert these models to a database schema using normalisation and foreign-key constraints. Non-relational data will also be considered, as well as the benefits and drawbacks of relational and non-relational models.
4-
5-
Objective: Students should be able to create an entity relationship diagram based on a qualatative description of data requirements, and translate that into a MySQL database schema. Students should also be able to compare and contrast relational (like MySQL) and NoSQL databases (considering their benefits and drawbacks).
3+
Objective: This class invites students to discuss Entity Relationship Diagram (ERD).
4+
Students should be able to explain their choices of entities, relationships, attributes etc.
5+
SQL injection should be explained with a demonstration (with a simple JS client).
6+
Concepts of database transaction, ACID properties, normal forms should be introduced with
7+
examples / live coding (creating a transaction, committing and rollback-ing).
68

79
## Pre-Class Readings
810

911
Before arriving to class on Sunday, please watch all of the videos in [this video playlist](https://www.lynda.com/SharedPlaylist/ae29ea2f495c432793abc220da47baa6) on Lynda.
10-
- Choosing Primary Keys
11-
- Defining One-to-Many Relationships
12-
- Exploring One-to-One Relationships
13-
- Exploring Many-to-Many Relationships
14-
- Understanding Relationship Rules and Referential Integrity
15-
- Defining Table Relationships
16-
- NoSQL databases
17-
- GraphQL: Introduction and History
18-
- Why use GraphQL?
1912

2013
Also, please read the following page that explains database foreign keys.
2114
- [What is a Database Foreign Key](http://databases.about.com/cs/specificproducts/g/foreignkey.htm)
2215

23-
## Main Topics
16+
## Topics to be covered
2417

25-
- More complex entity relationship diagrams
18+
### Entity Relationship Diagrams
2619
- Associative entities from many-to-many relationships
27-
- Introduction to normalisation
28-
- Foreign key constraints
29-
- Complicated values to store in MySQL
20+
- Boolean attribute instead of a table
21+
22+
### Normalization
23+
Database Design following normal forms as a convention.
24+
These normal forms build incrementally.
25+
E.g. The database is in 3NF if it is already in 2NF and satisfied the
26+
rules for 3rd normal form. Read [here] (https://www.studytonight.com/dbms/database-normalization.php) for more details.
27+
28+
#### 1NF (4 rules)
29+
* Rule 1 : Single valued attributes (each column should have atomic value, no multiple values)
30+
* Rule 2 : Attribute domain should not change
31+
* Rule 3 : Unique names for attributes / columns
32+
* Rule 4 : Order does not matter
33+
#### 2NF
34+
No partial dependency. (i.e. no field should depend on part of the primary key)
35+
Example
36+
```
37+
Score table (student_ID, subject_ID, score, teacher)
38+
Subject table (subject_ID, subject Name)
39+
```
40+
#### 3NF
41+
No transitive dependency (i.e. no field should depend on non-key attributes).
42+
43+
#### Boyce Codd Normal Form (3.5 NF)
44+
for any dependency A → B, A should be a super key.
45+
46+
#### 4NF
47+
No multi-value dependency.
48+
49+
### Complicated values to store in MySQL
3050
- Storing prices (floating point errors)
3151
- Storing dates (datetime vs. timestamp)
32-
- CREATE TABLE syntax
33-
- Brief introduction to non-relational data
34-
- Scaffolding and application generators
52+
- datetime : fixed value (joining date of employee): has a calendar date and a wall clock time
53+
- timestamp : unix timestamp, seconds elapsed from 1 Jan 1970 00:00 in UTC (takes timezone into consideration)
54+
55+
### Database transactions
56+
- A transaction is a set of commands that you want to treat as "one command." It has to either happen in full or not at all.
57+
58+
- A classical example is transferring money from one bank account to another. To do that you have first to withdraw the amount from the source account, and then deposit it to the destination account. The operation has to succeed in full. If you stop halfway, the money will be lost, and that is Very Bad.
59+
60+
### ACID properties
61+
62+
- **Atomicity** : states that database modifications must follow an “all or nothing” rule.
63+
Each transaction is said to be “atomic.”
64+
If one part of the transaction fails, the entire transaction fails.
65+
- **Consistency** : states that only valid data will be written to the database. If, for some reason, a transaction is executed that violates the database’s consistency rules, the entire transaction will be rolled back, and the database will be restored to a state consistent with those rules.
66+
- **Isolation** : requires that multiple transactions occurring at the same time not impact each other’s execution.
67+
- **Dependency** : ensures that any transaction committed to the database will not be lost. Durability is ensured through the use of database backups and transaction logs that facilitate the restoration of committed transactions in spite of any subsequent software or hardware failures.
68+
69+
### SQL injection
70+
71+
Some SQL clients accept input from user to fabricate the queries.
72+
A malicious user can tweak the input so as to acquire more information from the database or
73+
to destroy the database (literally!). Demo program `sql-injection.js` is in the `Week3` folder.
74+
75+
Consider the following query `SELECT name, salary FROM employees where id = X`.
76+
77+
#### Injection to get more information
78+
```
79+
If X is `101 OR 1=1`, then the query returns all records because 1=1 is always true
80+
SELECT name, salary FROM employees where id = 101 OR 1=1;
81+
```
82+
83+
#### Injection to destroy the database
84+
```
85+
If X is `101; DROP database mydb`, then the query will delete the entire database
86+
SELECT name, salary FROM employees where id = 101; DROP database mydb;
87+
```
88+
mysqljs prevents the second injection by not allowing multiple SQL statements
89+
to be executed at once.
90+
91+
### Understanding the asynchronous nature of database queries
92+
Jim (@remarcmij) wrote these [excellent demo programs](https://github.com/remarcmij/database_examples)
93+
for better understanding. Do check them out.
3594

3695
## Reference Material
3796

@@ -41,17 +100,3 @@ Also, please read the following page that explains database foreign keys.
41100
- [Yeoman](http://yeoman.io) - General framework for creating and scaffolding all types of projects
42101
- [Sails](http://sails.js) - Lightweight framework for generating APIs and web server apps in Node
43102
- [Loopback](http://loopback.io/) - A more "enterprise-ready" framework for generating and managing APIs.
44-
- [Rewatch the previously recorded session](https://www.youtube.com/watch?v=ZNLhHUDj6jo)
45-
46-
## Homework
47-
48-
For this week's homework:
49-
50-
Using an entity relationship diagram, design the data model for an application of your choice; this could be anything, but previous students have used a small business (with staff, offices, and job titles), a library (with books, genres, racks, members, and a borrowing log), or a farm (with animals, barns, and farmers). Your application must include at least one many-to-many relationship and any supporting tables (associative entities) that are needed. The entity relationship diagram must describe what tables you will need, the columns in these tables, which column is the primary key, and the relationships between tables.
51-
52-
Next, using the entity relationship diagram as a starting point, write all the necessary `CREATE TABLE` statements to create all tables and relationships (foreign key constraints) for this data model.
53-
54-
Submit an image or PDF of your entity relationship diagram, and a `.sql` file with the `CREATE TABLE` statements.
55-
56-
## Check out the React repo [here](https://github.com/HackYourFuture/React)
57-
And find out how you can prepare for the first React lecture :dancers:

‎Week3/sql-injection.js

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
var prompt = require('prompt');
2+
var mysql = require('mysql');
3+
const util = require('util');
4+
5+
const connection = mysql.createConnection({
6+
host : 'localhost',
7+
user : 'hyfuser',
8+
password : 'hyfpassword',
9+
database : 'class17',
10+
multipleStatements: true
11+
});
12+
13+
const execQuery = util.promisify(connection.query.bind(connection))
14+
const input = util.promisify(prompt.get.bind(this))
15+
16+
async function queryDatabase() {
17+
18+
var input_number = ""
19+
prompt.start();
20+
try {
21+
const result = await input(['number']);
22+
input_number = result.number
23+
24+
// 1. Naive way of passing the parameter to the query
25+
//const select_query = `select * from students WHERE student_number = ${input_number};`
26+
27+
// 2. Escaping the parameter ( replacing the unwanted characters)
28+
//const select_query = `select * from students WHERE student_number =` + connection.escape(input_number);
29+
// 3. Using a question mark syntax to do the escaping (AKA prepared statements)
30+
const select_query = `select * from students WHERE student_number = ?`
31+
32+
connection.connect();
33+
console.log(select_query);
34+
var results = await execQuery(select_query, input_number);
35+
} catch(error) {
36+
console.error(error);
37+
}
38+
39+
for (r of results) {
40+
console.log(r);
41+
}
42+
connection.end();
43+
}
44+
45+
queryDatabase();

‎examples/basic_mysql_connection/index.js

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎examples/basic_mysql_connection/package.json

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎examples/basic_mysql_connection/sqlinjection.js

Lines changed: 0 additions & 16 deletions
This file was deleted.

0 commit comments

Comments
 (0)