0

I came across this article written by Google's Webmaster which recommends setting/getting object parameters directly to improve code efficiency. However, I thought that doing as suggested (below) instead of accessing an object's properties through getter/setter methods) leaves the code vulnerable to attacks?

$rover = new dog();
$rover->name = 'rover';
echo $rover->name;
4
  • It means you lose control over the properties of your class, new properties can be added from outside the class Commented Sep 10, 2015 at 14:56
  • @MarkBaker unless you implement something in the __set magic method, there isn't really any way of stopping that, regardless of whether you use getters and setters. Commented Sep 10, 2015 at 15:01
  • @KevinNagurski - true, which is why it can be a good idea to have stub magic methods to prevent such events, alongside getters/setters to access properties Commented Sep 10, 2015 at 15:03
  • Note that that article specifically mentions naive setters, which really do exactly the same thing as ->name = .., just with the additional overhead of a function call. Commented Sep 10, 2015 at 15:08

1 Answer 1

4

There is no "security" implication at all. Code isn't more or less secure in terms of attackers over the internet because it does or doesn't use setters or getters. They don't "protect" anything in terms of security. What encapsulation and access control in the form of getters/setters does is to protect you from stomping on your own feet accidentally. $rover->name = .. allows you to assign anything to the attribute any time. $rover->setName(..) allows you to do some error checking when setting a value, which you can use to nip bugs in the bud earlier. But it does not prevent bugs entirely, nor does it prevent an attacker from doing malicious things. An attacker isn't going to write code to assign something to your properties. An attacker exploits bugs in code or logic loopholes; not property assignments.

Sign up to request clarification or add additional context in comments.

1 Comment

DANG IT! I was just in the middle of writing something similar. But you said it better my friend :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.