Search code examples
phpdatabasesecurityzend-frameworkzend-db

PHP universal Database Access


I want my PHP Zend Application to get access to the database.

Because the tasks are only two types: Get and Set a value from the database, I thought about simplifying it with universal methods.

It could look like this example.

namespace MyModule\Model;
use Zend\Db\Table\AbstractTable;

class MyTable extends AbstractTable
{
    protected $_name = 'tablename';

    public function getRow($selection)
    {
        $output = array();
        foreach($selection as $key => $value)
        {
            $row = $this->fetchRow($key ' = ' . $value);
            if (!$row) throw new Exception("error");
            array_merge($output, $row->toArray());
        }
        return $output;
    }

    public function addRow($values)
    {
        $this->insert($values);
    }

    public function updateRow($selection, $values)
    {
        foreach($selection as $key => $value)
        {
            $this->update($values, $key ' = ' . $value);
        }
    }

    public function deleteRow($selection)
    {
        foreach($selection as $key => $value)
        {
            $this->delete($key ' = ' . $value);
        }
    }
}

Are there any security or design arguments against this methods? I thought about making them global to access database like

 $row = database('mydatabase')->table('mytable')->getRow(array('id'=>'5'));

This solution would replace all the simple database models.


Solution

  • I think I'll provide a simple example of how Zend_Db works, then you can demonstrate what you intend I'm not sure I completely understand.
    The Model

    // /application/Models/DbTable/MyTable.php
    <?php
    class Application_Model_DbTable_MyTable extends Zend_Db_Table_Abstract {
    
        //actual name of database table
        protected $_name = 'My_Table';
        //name of primary key
        protected $_primary = 'id';
    
    }
    

    And the controller

    // /application/controllers/MyController.php
    <?php
    class Mycontroller extends Zend_Controller_Action {
    
        public function init() {
    }
    
        public function indexAction() {
            //instantiate DbTable Model and execute FetchAll returns Rowset object
            //call ->toArray() for array to be returned: $model->fetchAll()->toArray();
            $model = new Application_Model_DbTable_MyTable();
            $model->fetchAll();
    }
    

    with just this simple model all of your CRUD functions are already available to your models and controllers.
    We create new methods or override existing methods to provide more control over our business logic.
    Most of us have need for more then simple CRUD functions.
    For example I have a delete function that requires a check for other data to be successful:

    // /application/Models/DbTable/Track.php
     public function deleteTrack($trackId) {
    
            $trackRowset = $this->find($trackId);
            $trackToGo = $trackRowset->current();
    
            $usedBy = $trackToGo->findDependentRowset('Application_Model_DbTable_Member');
            if (count($usedBy) == 0) {
    
                $where = $this->getAdapter()->quoteInto('trackid = ?', $trackId);
    
                $this->delete($where);
            } else {
                throw new Zend_Exception('Track is still assigned to member(s) and cannot be deleted.'
                    . "<br />" . 'Members: ' . count($usedBy));
            }
        }
    

    I hope this adds some clarity to our discussion.