Seperating Database stuff from PHP code

[bobby_rahman]

Hiya,

I have seperated out my PHP code into many different layers

For example Login.html displays login screen to user. They enter details which is posted to login.php. Within login.php have some code which does something similar to

if login(username, password)
{
//do something
}

login.php calls user.api which defines the login function.
function login(username, password)
{
$querystring = ("select * from user
where username='$username'
and password = password('$password')");
db_query($querystring)

This calls the function db_query in db.api.php :
function db_query($querystring)
{
$db_result = mysql_query($querystring);
}

Now the problem is that one person advised me it is not good to send the whole querystring to db.api and to use $REQUEST instead of $SESSION im using to pass globval variables.

Now the reason I designed it like this was to be able to change the database in one file db.api.php if neccessary.

Can anyone tell me how I can use $_REQUEST and also keep some level of database abstraction from the user.api.php, the login.php and login.html

Any suggestions would be great

PS ( how hard would it be to convert all my db code to work with PEAR db)

Cheers

Bobster

[matt_4013]

There's nothing wrong with using session variables like you are. $_REQUEST gets all input variables from any user input, and, like it says in the PHP manual (http://au.php.net/manual/en/reserved.variables.php#reserved.variables.request), should not be trusted. You do have a measure of security using sessions.

Pass the login variables using POST.

This is the way I do it:

function login_form() {

echo "<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">";
echo "<input type=\"text\" name=\"username\">";
echo "<input type=\"password\" name=\"password\">";
echo "<input type=\"submit\" name=\"submit\" value=\"Login\">";
echo "</form>";

}


if(!isset($_POST['submit'])) {

include 'header.inc.php';
login_form();
include 'footer.inc.php';

} else {

include 'dbconnect.inc.php'; // This contains all my database connect functions

$sql = "SELECT user_id, username, othershit FROM users WHERE username='".$_POST['username']."' AND password=password('".$_POST['password']."')";
$result = mysql_query($sql, $db) or die(mysql_error());

if(mysql_num_rows($result) > 0) {

	$data = mysql_fetch_assoc($result);

	foreach($data as $k=>$v) {

		$_SESSION['logged_in'] = true;
		$_SESSION[$k] = $v;
	}

	header("Location: index.php");
} else {

	include 'header.inc.php';
	echo "<h3>Invalid Username or Password</h3>";
	login_form();
	include 'footer.inc.php';
}
}

[matt_4013]

Also, if you really want your database functions kept apart, and can't be bothered coding your own class, have a look at ADOdb, it's pretty funky. I've been using it in a project I'm doing at the moment, and quite powerful 🙂