Skip to main content
added 1 character in body
Source Link

The application would require the user to provide his/her username and password and then it would just check the database whether he/seshe is a valid user or not.

The application would require the user to provide his/her username and password and then it would just check the database whether he/se is a valid user or not.

The application would require the user to provide his/her username and password and then it would just check the database whether he/she is a valid user or not.

Source Link

Am I correctly implementing PHP/PDO and the MVC/DAO pattern?

Context:

I am working on the login module of a PHP web-application and I am trying to implement this using PHP/PDO and the DAO pattern. I would like someone to review the code below and let me know whether my understanding is correct or not,i.e, am I implementing it correctly.

The application would require the user to provide his/her username and password and then it would just check the database whether he/se is a valid user or not.

user_master:

enter image description here

Project Structure:

enter image description here

login_handler.php:

<?php

require ("include_dao.php");

// Fetch the supplied username and password.
$username = $_POST['username'];

$password = $_POST['password'];

// Instantiate and populate UserMaster bean.
$usermaster = new UserMaster;

$usermaster->setUsername($username);

$usermaster->setPassword($password);

// Instantiate and invoke the desired DAO method.
$usermasterDAO = new UserMasterMySqlDAO;

$usermasterDAO->queryByUsernameAndPassword($username, $password);

?>

queryByUsernameAndPassword():

public function queryByUsernameAndPassword($username, $password) {

        // Initiate DatabaseHandler instance.
        $databaseHandler = new DatabaseHandler;

        // Establish a connection
        $pdoConnection = $databaseHandler -> connect();

        try {
            $query = $pdoConnection -> prepare('SELECT * FROM cbiz.user_master WHERE username = ? AND password = ?');

            $query -> bindParam(1, $username, PDO::PARAM_STR);

            $query -> bindParam(2, $password, PDO::PARAM_STR);

            $query -> execute();

            if ($query -> execute()) {
                echo "TRUE";
            } else {
                echo "FALSE";
            }

        } catch (PDOException $pdoException) {// Write into log and show the exception message.

            $databaseHandler -> closeConnection();

            echo $databaseHandler -> logException($pdoException -> getMessage());

            die();
        }
    }

DatabaseHandler - Constructor:

/*
     * ###################### Constructor.######################
     *
     * 1. Instantiate Log class
     * 2. Connects to the database.
     * 3. Creates the parameters array.
     */
    public function __construct() {
        $this -> log = new LogHandler();
        $this -> connect();
    }

DatabaseHandler - connect():

/**
     *  ########## METHOD 1 - ESTABLISHES A CONNECTION TO THE DATABASE #########
     *
     * 1. Reads the database settings from an ini file.
     * 2. Tries to connect to the database.
     * 3. If connection failed, exception is displayed and a log file gets created.
     */
    public function connect() {

        $path_to_config_file = $_SERVER['DOCUMENT_ROOT'] . '/SMS/core/config/' . 'config.ini';

        // Read settings from INI file.
        $this -> settings = parse_ini_file($path_to_config_file);

        // Set the Data Source name - mysql:host=127.0.0.1;dbname=cbiz
        $dsn = 'mysql:dbname=' . $this -> settings["dbname"] . ';host=' . $this -> settings["host"] . '';

        $username = $this -> settings["db_user"];

        $password = $this -> settings["db_password"];

        // Set UTF8 .
        $options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8', );

        try {

            $this -> pdoObject = new PDO($dsn, $username, $password, $options);

            // Log any exceptions on Fatal error.
            $this -> pdoObject -> setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

            // Disable emulation of prepared statements, use REAL prepared statements instead.
            $this -> pdoObject -> setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

            // Connection succeeded, set the boolean to true.
            $this -> isConnected = true;
            
            // echo "Connection established!";          
            
            return $this->pdoObject;

        } catch (PDOException $pdoException) {// Write into log and show the exception message.

            echo $this -> logException($pdoException -> getMessage());

            die();
        }

    }

Any help, suggestions, criticisms are appreciated.