[RyanRobinson]

Hi,

I am quite intrigued by how different PHP developers handle form data that goes into a database.

Do you handle the form data individually and use IF statements to ensure they are valid etc?

Do you manually write the SQL INSERT/UPDATE and PDO queries?

I'm not trying to "steal" ideas or methods, I just simply want to know how different people approach this process.

Thanks.

[Faitas]

Hello, Ryan,

I usually use CodeIgniter PHP framework, so I can type some lines and framework validate it itself. (I use form validation class).

[Dormilich]

generally, I use PHP’s filter functions and Prepared Statements for DB queries.

[RyanRobinson]

I am aware of the various validation techniques but do you actually hand type the validation code for each field submitted?

Example.

if($_POST['name'] != '') {
   $name = strtoupper($_POST['name']);
}

if(filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
   $email = $_POST['email'];
}
...

The same goes for the SQL string. Do you actually hand type the prepared statement?

[Dormilich]

RyanRobinson, on 04 January 2013 - 05:11 PM, said:

Do you actually hand type the prepared statement?

no. one feat of OOP is re-useability.

[CTphpnwb]

Here's something you might find helpful:

<?php
$myform = <<<HERE
<form method="post">
Name: <input type="text" name="name" value="{name}"><br>
Address: <input type="text" name="address" value="{address}"><br>
Phone: <input type="text" name="phone" value="{phone}"><br>
<input type="submit" value="submit">
</form>
HERE;

class validation {
	protected $name;
	protected $address;
	protected $phone;
	protected $expected = array("name", "address", "phone");
	
	function __construct($arr) {
		$this->infos = array();
		foreach($this->expected as $key) {
			if(!empty($arr[$key])) {
				$this->$key = $arr[$key];
			} else {
				$this->$key = "";
			}
			$this->infos[] = $this->$key;
		}
	}
	
	function get_all() {
		$data = array();
		foreach($this->expected as $key) {
			$data[] = $this->$key;
		}
		return $data;
	}
	
	function validate_all() {
		$errors = array();
		foreach($this->expected as $key) {
			$func = "validate_".$key;
			if(!$this->$func()) {
				echo "???<br>";
				$errors[] = 1;
			}
		}
		return $errors;
	}
	
	function validate_name() {
		return true; // Replace with validation code for this property
	}
	
	function validate_address() {
		return true; // Replace with validation code for this property
	}
	
	function validate_phone() {
		return true; // Replace with validation code for this property
	}
	
	function save_info($pdo) {
		// Code to save in database.
	}
}

$form_names = array("name", "address", "phone");
$form_types = array("text","text","phone");
$form_values = new validation($_POST);

$errors = $form_values->validate_all();
if(count($errors) > 0) {
	echo "The form did not validate properly<br>";
}

$replace = array("{name}", "{address}", "{phone}");
$output = str_replace($replace, $form_values->get_all(), $myform);

echo $output;

This post has been edited by CTphpnwb: 04 January 2013 - 12:25 PM

[RyanRobinson]

Hmmm some good techniques here. However, do any of you get sick of hand cranking this code for each field? I've been playing around with some code recently and I have managed to put together some really neat code. I have looked around quite extensively to find other examples of what I'm trying to do but couldn't find anything. I was quite surprised that there is a lot devs still writing a lot of code.

[CTphpnwb]

A class like this could be stored in its own file and included in projects with little or no modification. There's no need to hand crank anything.

[RyanRobinson]

Yes I know that you can just include that class. But it means adding more protected properties and array items for each new field you want to process. Depending on the project, your class could just keep growing and will be harder to maintain.

[CTphpnwb]

No matter what you do you'll need at least another function for each type of field you want to validate.

You could make it a little simpler by making the fields be a protected array in the class, but it doesn't seem like you'd gain much and I thought it would have clouded the point I was trying to make so I didn't do it in my example.