Using GET, POST, REQUEST in OOP

[Barefootsanders]

Hi all. I have a current PHP script which checks a number of GET, POST, and REQUEST variables. These are currently in a top-down PHP file and these variables control the flow of the application. I want to convert file to a PHP class, create an object and then access the class functions to perform actions in my application. I'm wondering are there any problems with creating a PHP like this:

class foo {
    function __ construct() {
    }
    function fooBar() {
        if($GET['param1'])
            return 1;
        return 0;
    }
};

$obj = new foo();

And then in my other documents I can just check the value of fooBar via:

<?php if(fooBar()) {....} ?>

Now this isn't exactly what I'm trying to do but it illustrates it. Is this good? i.e. proper practice? If not, how can I accomplish what I'm trying to do.

Thanks.

[kkeith29]

Those are called superglobals and they will work inside a class. Also the way you called the method in the if statement is incorrect. I hope you know that.

FYI: _POST and _GET are part of _REQUEST. Make sure you use the specific request type. Using _REQUEST isn't the best thing to do.

[Barefootsanders]

Those are called superglobals and they will work inside a class. Also the way you called the method in the if statement is incorrect. I hope you know that.

FYI: _POST and _GET are part of _REQUEST. Make sure you use the specific request type. Using _REQUEST isn't the best thing to do.

Thanks for the response. How can I use them then? I'm going to assume pass them in as parameters? The only problem with that is that my program relies on $_GET and $_POST for program flow. What I'd have to do is pass them in before the HTML starts to set them and then just check them. Does that sound right?
And yes, I know the if syntax isnt correct.. Just threw up a quick example. Thanks though!

[kkeith29]

You do not have to pass them as params. They can be used anywhere. Your example will work just fine.

[Barefootsanders]

You do not have to pass them as params. They can be used anywhere. Your example will work just fine.

O wow, sorry. I read your previous post wrong.

Thanks!

[ShawnCplus]

As was noted before, they are superglobals, you can use them anywhere. However, I suggest that you don't. If you're going to go the OOP route then I would suggest abstracting dealing with GET/POST/COOKIE/SESSION variables to a class that deals with them specifically called Request or something along those lines that can appropriately sanitize/parse/etc.

[Barefootsanders]

As was noted before, they are superglobals, you can use them anywhere. However, I suggest that you don't. If you're going to go the OOP route then I would suggest abstracting dealing with GET/POST/COOKIE/SESSION variables to a class that deals with them specifically called Request or something along those lines that can appropriately sanitize/parse/etc.

Abstraction is one thing I'm not too advanced with.. Could you provide an example of what you mean by an abstraction layer using the GET/POST/etc... variables? Any help would be appreciated.

Thanks.

[ShawnCplus]

I'll give you a pretty advanced example for the sole reason for you to learn from.

<?php
class Request
{
  const TYPE_NONE   = 0;
  const TYPE_ALPHA  = 1;
  const TYPE_DIGIT  = 2;
  const TYPE_ALNUM  = 3;

  const GET         = 10;
  const POST        = 11;
  const COOKIE      = 12;
  const SESSION     = 13;

  public static function get($name, $method = null, $validation = null)
  {
    if ($method < self::GET && $validation === null) {
      $validation = $method;
      $method = self::GET;
    } else if ($method === null ) {
      $method = self::GET;
    }

    if ($validation === null) {
      $validation = self::TYPE_NONE;
    }

    $holder = null;
    switch ($method) {
      case self::GET:
        $holder = $_GET;
        break;
      case self::POST:
        $holder = $_POST;
        break;
      case self::COOKIE:
        $holder = $_COOKIE;
        break;
      case self::SESSION:
        $holder = $_SESSION;
        break;
    }

    if (!isset($holder[$name])) {
      return false;
    }

    $validator = null;
    switch ($validation) {
      case self::TYPE_ALNUM:
        $validator = 'alnum';
        break;
      case self::TYPE_DIGIT:
        $validator = 'digit';
        break;
      case self::TYPE_ALPHA:
        $validator = 'alpha';
        break;
    }

    $ret_val = $holder[$name];
    $valid_func = 'ctype_' . $validator;
    return (($validator === null) ? $ret_val : (( $valid_func($ret_val) ) ? $ret_val : null ) );
  }
}

USAGE:

// basic GET param with no validation
$blah = Request::get('blah');
// GET param with validation
$blah = Request::get('blah', Request::TYPE_DIGIT);
// POST param
$blah = Request::get('blah', Request::POST);
// POST param with validation
$blah = Request::get('blah', Request::POST, Request::TYPE_ALNUM);

Now, given that PHP 5.3 has been released I could've gotten REALLY fancy and allowed the $validation parameter to be a lambda callback (I'm running 5.3 so I could've but I HIGHLY doubt you are so I didn't)

[Barefootsanders]

Wow thanks so much for that. I thought you meant an actual abstract class, i.e:

abstract class foo {...}

One question though.. is there any significance behind the values of the constants or did you just arbitrarily pick them?

Thanks again.

[ShawnCplus]

Wow thanks so much for that. I thought you meant an actual abstract class, i.e:

abstract class foo {...}

One question though.. is there any significance behind the values of the constants or did you just arbitrarily pick them?

Thanks again.

Well, arbitrary in the sense that they aren't language constants but I picked the names because their purpose is easy to determine.

[iThaos]

You really shouldn't use $_REQUEST;
1. You don't know if it comes from $_GET or $_POST when you really only want it from $_POST. Mostly to do with security.
2. Depending on the server settings, PHP may register one over the other so may be using a parameter that the user entered into the url.

Example: http://www.example.com/?user_auth=true when you really posted $_POST['user_auth]=FALSE; . Really bad example but that is the main idea.