Structure pages mvc + oop

Question

I am developing a website and I want to use PDO and MVC.

Before, I was coding in procedural MySQL, but I'm starting to understand the object-oriented programming.

My problem is the following:

If I understand the MVC pattern, there are 3 parts

1. View (It's my Html)
2. Model (PHP requests)
3. Controller (Control and form validation)

Right?

I want to know if I have the right approach to MVC.

So, I put code that works and I try to change in MVC. (My test MVC is lower in the page.)

$db = new DbConnect();
$error = '';
if(isset($_POST['login_submit'])){
   if(empty($_POST['login']) || empty($_POST['password'])){
       $error = 'All fields required';
   }else{
       $db->query('SELECT * FROM users WHERE u_login = :login AND u_password = :password');
       $db->bind(':login', $_POST['login']);
       $db->bind(':password', md5(sha1($_POST['password'])));
       $row = $db->single();
       if($db->rowCount() > 0){
           echo 'I can save some informations by sessions';
           echo '<pre>';
           print_r($row);
           echo '</pre>';
       }else{
           $error .= 'Not find in the Data Base';
       }
   } 
}
if(!empty($error)){
    echo $error;
}

Here the html form:

<form action="login" method="post" name="login">
<label for="login">Login:
    <input type="text" name="login" id="login">
</label>
<label for="password">Mot de passe:
    <input type="password" name="password" id="password">
</label>
<input type="submit" name="login_submit" value="Se connecter">

Now I try to evolve towards the MVC model like this:

1. My Model called model.login.php:

class Auth extends DbConnect{
    protected $login;
    protected $password;
    protected $email;

    public function ConnectSecure(){
        if(isset($_POST['login_submit'])){
            CheckPostLogin();
            $this->query('SELECT * FROM users WHERE u_login = :login AND u_password = :password');
            $this->bind(':login', $_POST['login']);
            $this->bind(':password', md5(sha1($_POST['password'])));
            $this->single();
            if($this->rowCount() > 0){
                echo 'OK and I put some informations by sessions';
            }else{
                echo 'No in DB or error combination user/password';
            }
            echo '<pre>';
            print_r($result);
            echo '</pre>';
        }
    }
}

2. My controller called controller.login.php:

require 'models/model.login.php';
function CheckPostLogin(){
    if(empty($_POST['login']) || empty($_POST['password'])){
        Message::ShowError('All fields required.');
        return false;
    }
}

3. My view has the same HTML code listed above.

I have also a global class that will handle static functions to display messages for error, success, etc. like this (just an example):

class Message{
    public static function ShowError($message){
        echo $message;
    }
}

I have another problem:

Inside my model, after the query, I check if I have some result. I think this part need go on the controller. Right? If yes, how can I do this properly?

I'm new to OOP. If you see any errors or discrepancies, your advice is welcome.

Answer 1

^{Well .. you do not understand MVC design pattern. You seem to got all three parts wrong. Since I am quite lazy person, I will just direct to some older posts of mine that might help you to deal with handling pdo, some initial studies for the subject, basics of views, model layer, some minor note on controllers. Also there is a bit about access control in context of MVC, that might be useful to you.}

Now! To the code ...

File: model.login.php

• Model is not subtype of database connection (wel .. model is not even a class). This class is violating SRP ^{[1], [2], [3]} .

• Aside from making a pointless wrapper for PDO, there is also a serious problem there: md5(sha1( ... )) should NEVER be used for hashing passwords. Please read the following three posts from @ircmaxell.

File: controller.login.php

• You should learn how to use autoloader. Start by reading the documentation about spl_autoload_register(). Also I would recommend to look into what are namespaces and how then can be used together with autoloading schemes.

• Don't us static method calls. Just because you wrap something in a class does not make it object-oriented (notice how it isn't called "class-oriented programming" .. there is a distinction). When used this way, your class acts only as namespace for your global-scope functions.

... the rest, IMHO, is covered in the linked posts above.