PHP - Php Best Practices?

To execute code on successfully submitting text input, is this "bare minimum" code secure enough?

if(!empty($_POST["textfield_input"])) {
//execute code
}

...or is it best to make sure all 4 of these are confirmed:

if (
($_SERVER['REQUEST_METHOD'] == 'POST') &&
isset($_POST["submit_button_name"] &&
isset($_POST["form_name"] &&
(!empty($_POST["textfield_input"]))
) {
//execute code
}

The html portion is simply:
<form name="form_name" method="post" action="somepage.php">
<input type = "text" name="textfield_input">
<input type="submit" name="submit_ button_name">
</form>

I've searched on the net about this several times, and see different answers, and it looks like each PHP expert has their favorite.... but I would rather know the "best practices" answer to this.

Thank you!!

 

 

Edited November 5, 2019 by StevenOliver

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=351660.0

Scenario: My page generates several PHP variables. Some of those variables get posted to another page.

Question: If a variable is to be assigned to a Session, is there any reason to assign this value to a regular PHP variable?

Example: When an API generates a "shipping label tracking number, which is better, "A" or "B" or subtle variation "C":

A.) 
$result = json_decode(curl_exec($ch));
$_SESSION["trackingNumber"] = $result->parcelTrackingNumber;

... and then use $_SESSION["trackingNumber"] throughout the rest of my script (like this: echo  "Hello, here's your tracking number: ".$_SESSION["trackingNumber"]).

B.) 
$result = json_decode(curl_exec($ch));
$trackingNumber = $result->parcelTrackingNumber;
$_SESSION["trackingNumber"] = $trackingNumber;

... and then use "$trackingNumber" throughout the rest of my script (like this: echo  "Hello, here's your tracking number: ".$trackingNumber).

C.) 
$result = json_decode(curl_exec($ch));
$_SESSION["trackingNumber"] = $result->parcelTrackingNumber;
$trackingNumber = $_SESSION["trackingNumber"];

... and then use "$trackingNumber" throughout the rest of my script (like this: echo  "Hello, here's your tracking number: ".$trackingNumber).

Thank you! I've always wondered about this. Which is best?

 

 

Hello all. I'm looking to build a website in php that will be large in scope and I'm looking for some direction as to how to go about coding it. What I'm referring to exactly is the programming model. I'm new to the language, but not to programming, and I've read up on it and familiarized myself with the syntax over the past few days. Normally when I go about building a project I like to plan ahead how I'm going to build It so I don't run into tedious issues later on and this is what I need help with.   My concerns:  I am looking to use the alternative syntax for control structures as to make the php code inside my html readable and easier to manage but in terms of OOP when is it best for me to use classes vs functions?  I am leaning towards using both classes and functions. Classes to handle polling data, sanitizing it and storing it while the functions will be used , with the alternative syntax, to display the data. How should I go about properly setting my project assuming I will have many concurrent users using the website at once? Is using xml / INI files as a directory to look up information a good practice? Is it better to declare constant variables instead? When working with multiple includes is there an easier way to include a file than having to explicity write "dirname( dirname(__FILE__) )" everytime?   I'm essentially looking for guidance / tips as to good programming practices with this language Advanced practices are welcomed as well.     Development Tools: XAMPP ( Windows 7 Pro ) PHPStorm    Current directory structure plan:   Here is what I currently have:     The API class is a collection of functions that returns an object to be used at a later data.

<?php

/*
 * Development API Key
 * @since 1.0
 *
 * Rate Limit(s):
 * 10 request(s) every 10 second(s)
 * 500 request(s) every 10 minute(s)
 */
define( "__API_KEY__" , "---------------------------------" );

require_once dirname( dirname(__FILE__) ) . "\\settings.php";

class API
{

    // If successfull it returns an object from the url that's passed to this function.	
    private function api_call($url)
    {
	$result = null; // end result

        // Create a new curl handle.
        $ch = curl_init();

        curl_setopt($ch , CURLOPT_URL, "https://" . $url . "?api_key=" . __RIOT_API_KEY__); // set the URL
        curl_setopt($ch , CURLOPT_RETURNTRANSFER , true  ); // return the transfer as a string of the return value
        curl_setopt($ch , CURLOPT_SSL_VERIFYPEER , false ); // turn off ssl certificate verification

        // Execute the api call
        $response = curl_exec($ch);
        // Get info to analyze the result
        $ci = curl_getinfo($ch);

        $httpcode = $ci["http_code"];

        // If a curl error occured
        if(curl_errno($ch) || ($httpcode != "200"))
        {
            $die  = "Curl Error Code: "    . $httpcode       . "<br/>";
            $die .= "Curl Error Message: " . curl_errno($ch) . "<br/>";
            $die .= "Curl URL: "           . $ci["url"]      . "<br/>";
            die($die);
        } else {

            // Check if the api call we made was valid

            $response = json_decode($response, true);

            // If our response is an array check if it's an error response
            if(is_array($response))
            {
                $error_key = "status";
                if(array_key_exists($error_key, $response))
                {
                    $er = $response[$error_key];
                    $die  = "API Error Message: " . $er["message"]     . "<br/>";
                    $die .= "API Error Code: "    . $er["status_code"] . "<br/>";
                    die($die);
                }
            }

            // Our response is a valid object
            $result = $response;
    }

    private function sanitize_url($url)
    {
        // removes all whitespaces
        return trim(preg_replace( '/\s+/','',$url));
    }

    private function regional_endpoints()
    {
        static $regionini;

        if(is_null($regionini))
            $regionini = parse_ini_file(INI_REGIONAL_ENDPOINTS, true);

        return $regionini;
    }

    private function region_host($shortcode)
    {
        /*
         * regionalendpoints.ini
         * @since 1.0
         *
         * [SHORTCODE]
         * Description=<region_description>
         * Host=<host_url>
         */
        return $this->regional_endpoints()[strtoupper($shortcode)]["Host"];
    }

    public  function region_description($shortcode)
    {
        /*
        * regionalendpoints.ini
        * @since 1.0
        *
        * [SHORTCODE]
        * Description=<region_description>
        * Host=<host_url>
        */
        return $this->regional_endpoints()[strtoupper($shortcode)]["Description"];
    }

    public function api_object_by_name($name, $region)
    {
        /*
         * @Description: Get summoner objects mapped by standardized summoner name for a given list of summoner names.
         *
         *
         * @Returns: Map[string, SummonerDto]
         *
         * Object
         * ------------------------------------------------------------------------------------------------------
         * Name             Data Type          Description
         * ------------------------------------------------------------------------------------------------------
         * id	            long	           ID.
         * name	            string	           Name.
         * profileIconId    int                    ID of the summoner icon associated with the summoner.
         * revisionDate	    long	           Date summoner was last modified specified as epoch milliseconds.
         * Level            long	           Level associated with the summoner.
         */

         $api_url = "%s/api/col/%s/v1.4/obj/by-name/%s";

        return $this->api_call(sprintf($api_url,
            $this->region_host($region),
            strtolower($region),
            $this->sanitize_url($name)));
    }

}

Class that acts as the middle man between the api and the front end. Currently how it is set up it handles an internal queue.

<?php

include dirname(__FILE__) . "\\class-riotapi.php";

define( "SUMMONER_NAME" , 0 );
define( "SUMMONER_ID"   , 1 );

class Summoner
{

    private $riotapi        = null;

    private $summoner       = null;
    private $arr_summoners  = null;
    private $region         = null;


    public function __construct()
    {
        // Create our riot api object
        $this->riotapi = new RiotAPI();
    }


    public function summoner_exists($summoners, $region, $type = SUMMONER_NAME)
    {
        static $eoa; // end of array

        // If our array of summoners is empty or we have reached the end of the array.
        if( empty($this->arr_summoners) || $eoa )
        {
            // Get an array of summoner information from the riot api based on the type of information
            // supplied.
            switch($type)
            {
                case SUMMONER_NAME :
                    $this->arr_summoners = $this->riotapi->api_summoner_by_name($summoners, $this->region = $region);
                    break;

                case SUMMONER_ID :
                    $this->arr_summoners = $this->riotapi->api_summoner_by_id($summoners, $this->region = $region);
                    break;
            }

            // If our array of summoners isn't empty.
            if( !empty($this->arr_summoners) )
            {
                // Set our current summoner the first element in the array.
                $this->summoner = reset($this->arr_summoners);
            } else {
                // We failed to acquire any summoner information so return false.
                return false;
            }

            $eoa = false;

        } else {

            // If we have not reached the end of the summoners array set our current
            // summoner to the next element.
            $next = next($this->arr_summoners);

            // Have we reached the end of the array?
            if( $next ) {
                // No. Set our current summoner to the next element.
                $this->summoner = $next;
            } else {
                // Yes. Set our end of array variable to true.
                $eoa = true;
                // End the loop
                return false;
            }

        }

        return true;
    }


    public function summoner_id()
    {
        return $this->summoner["id"];
    }


    public function summoner_name()
    {
        return $this->summoner["name"];
    }


    public function summoner_profile_icon_id()
    {
        return $this->summoner["profileIconId"];
    }


    public function summoner_last_updated()
    {
        return $this->summoner["revisionDate"];
    }


    public function summoner_level()
    {
        return $this->summoner["summonerLevel"];
    }


    public function summoner_mastery_pages()
    {
        return $this->riotapi->api_summoner_masteries($this->summoner_id(),
            $this->region)[$this->summoner_id()]["pages"];
    }

}

Functions.php file that is a collection of functions that echo out information. 

<?php

require_once "settings.php";
include DIR_INCLUDE . "class-summoner.php";

function summoner_exists($summoners, $region = "NA", $type = SUMMONER_NAME)
{
    global $cs;
    if(!isset($cs)){
        $cs = new Summoner();
    }
    return $cs->summoner_exists($summoners, $region, $type);
}

function summoner_name()
{
    global $cs;
    if(isset($cs)){
        echo $cs->summoner_name();
    }
}

?>

index.php - Example of how I'm currently using the functions.php file.

<?php include "functions.php"; ?>
<html xmlns="http://www.w3.org/1999/xhtml">
<body>

<?php while(summoner_exists("cyllo")) : ?>

    <div>Summoner Name: <?php summoner_name(); ?></div>
    <div>Summoner ID: <?php summoner_id(); ?></div>
    <div>Summoner Profile icon ID: <?php summoner_profile_icon_id(); ?></div>
    <div>Last Updated: <?php summoner_last_updated(); ?></div>
    <div>Summoner Level: <?php summoner_level(); ?></div>

    <div>
        <?php mastery_pages(); ?>
    </div>

<?php endwhile; ?>
</body>
</html>