How to handle REQUEST in PHP

Question

is there a class to handle $_REQUEST that makes the life of a php developer easier? I want to handle the client requests easier. I dont want to test with if(is_set($_REQUEST['blabla'])) {makesomthing();} I wish there could be a solution like this.

class rpclike
{
 public function getMember()
 {
  $memberid = $this->inputhandler['memberid'];
  $member = $this->memberclass->getmember($memberid);

   foreach($member as $mem)
   {
    echo $mem->id;
   }
 }

}

$rpc = new rpclike();

then if i call the rpclike from a javascript like this

<a href="#" onclick="GETURL("rpclike.php?getMember&memberid=22")">Get member</a>

Which class can do something like that?

Allowing the users to decide what will be called will always end in disaster. — Cfreak
– Cfreak, Commented Jan 6, 2010 at 22:59
i realy cant understand why the question is getting down voted, its a normal question. I think There is no reason to down vote — streetparade
– streetparade, Commented Jan 6, 2010 at 23:00
I don't like it because its prone to security problems. Any function you put in that class is going to be exposed to the web. You might be the lone developer for your project but someone else may see this and think it's a good idea, implement it and someone working on their project might not know the exposure and implement a delete_user method or something similar. — Cfreak
– Cfreak, Commented Jan 6, 2010 at 23:09

Corey Ballou · Accepted Answer · 2010-01-06 22:56:41Z

2

It's not recommended that you use $_REQUEST as it poses security concerns. You should be using one of $_GET, $_POST, or $_COOKIE depending on what global request var you are trying to retrieve. Your best bet would be to have something like the following:

class input {

    public static function get($key, $value = false) {
        return (!empty($_GET[$key])) ? $_GET[$key] : $value;
    }

    public static function post($key, $value = false) {
        return (!empty($_POST[$key])) ? $_POST[$key] : $value;
    }

    public static function cookie($key, $value = false) {
        return (!empty($_COOKIE[$key])) ? $_COOKIE[$key] : $value;
    }

}

You could then use the class like:

if (input::post('field', null) != null) {

}

or

if (input::get('field', false) != false) {

}

Although this still requires testing, you can explicitly set the return values in the event no data was set for the global variable.

answered Jan 6, 2010 at 22:56

Corey Ballou

43.7k8 gold badges66 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Alix Axel Over a year ago

Don't forget to implement a get_magic_quotes_gpc() workaround.

Corey Ballou Over a year ago

Very true, thought about mentioning it... I'm just so used to having it turned off myself.

zombat · Accepted Answer · 2010-01-06 22:56:54Z

1

PHP doesn't really have a default class structure that you can utilize in that kind of manner, as it's origins are in procedural-based programming.

It would be fairly trivial for you to create a class like that if you felt the need for it. However, you would really just be adding overhead. If the convenience of it is worth it for you, then you could utilize the __get() and __set() methods to handle existence checks for you.

The fact that you want to use this for handling client requests in an easier fashion is probably a good indicator that you should move to something like an MVC framework, which usually handle URLs and route them to appropriate methods for you automatically. Most PHP frameworks will do this for you already. For a nice overview on how the process commonly works, you could see how CodeIgniter does it.

answered Jan 6, 2010 at 22:56

zombat

94.5k25 gold badges158 silver badges165 bronze badges

1 Comment

streetparade Over a year ago

thank you, you motivated me to use from now and the most time just the framewort codelgniter, have a nice evening

funwhilelost · Accepted Answer · 2010-01-06 23:00:58Z

1

Aside from the obvious security risks involved in this, it is feasible. It's a common pattern to use for steering requests in an MVC system.

Say you request index.php?class=User&method=ViewProfile

$module = new $_GET['class']();
if(!method_exists($module,$_GET['method']))
$module->$eventName();

answered Jan 6, 2010 at 23:00

funwhilelost

2,01018 silver badges20 bronze badges

Comments

Joe · Accepted Answer · 2010-01-06 22:50:49Z

0

I don't think so. Being able to invoke an arbitrary method would be a massive security hole.

answered Jan 6, 2010 at 22:50

Joe

48k37 gold badges166 silver badges261 bronze badges

2 Comments

streetparade Over a year ago

sure but first i would call before doing anything if(!$this->user->isadmin()) return false;

Joe Over a year ago

That's not necessarily the point. Assuming your system isn't secure (no system is 100% secure) and someone managed to spoof the admin credentials, they could potentially perform any operation. If you do your own dispatch you can at least limit this.

slebetman · Accepted Answer · 2010-01-06 23:10:40Z

-1

Do something like:

url: /foo/bar?req=getMembers&memberid=22

Then you can do:

$request = $_GET['req'];
$request();

Slightly less dangerous version:

$req_methods = array(
    getMembers => 'some_function',
    saveMembers => 'another_function',
    sendMessage => 'send_him_an_email'
);
$request = $_GET['req'];
$req_methods[$request]();

edited Jan 6, 2010 at 23:10

answered Jan 6, 2010 at 22:57

slebetman

115k19 gold badges148 silver badges181 bronze badges

3 Comments

Frank Farmer Over a year ago

That seems just a little risky. E.g., what if someone requests something like /foo/bar?req=apache_child_terminate or some other dangerous function?

slebetman Over a year ago

added slightly less dangerous version.

Corey Ballou Over a year ago

i would still suggest wrapping the latter with isset($req_methods[$request])

Collectives™ on Stack Overflow

How to handle REQUEST in PHP

5 Answers 5

2 Comments

1 Comment

Comments

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

1 Comment

Comments

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related