What do you suggest - setters question

PHP
1

Hello all,

I will make a lot of assumptions here, if some are not precise, please, let me know.

I’m having this application that receives data from a $_POST;
I’m using Value Objects to work with values on my methods.

So, when we POST something, I’m setting some VO.

In order to make my $_POST more secure, I would like to add htmlentities() to them.

What I thought? Why not, add them, not on the “view part” but, on my VO class. :smiley:

So, I thought (again), I could add some method to that VO class that takes care of that:

The code or thing:


class DominioVo
{
    private $_nome;
    
    /**
     *
     * @param <string> $setter
     * @return <encoded string> 
     */
    private static function protect($setter) 
    {
        return htmlentities($setter, ENT_QUOTES, 'UTF-8');
    }
    
    public function setNome($nome)
    {
	$this->_nome = self::protect($nome);
    }

    public function getNome()
    {
	return $this->_nome;
    }

...

Is this a nice approach? Or is just crazy and useless? Or some third option? :slight_smile:

Does private static makes more sense then private only? I would like to state that this method is for class use only. I know private does just that… I’m just wondering about the static one… :confused:

I’m starting to think: what about if I want to make sure that the value passed, if it needs to be an int, is actually a int?
If that’s the case, I need to add something else, and this seems to don’t work so well on this last scenario… ?

Any thoughts to share? :slight_smile:

k. Regards,
Márcio

2

Thank you Immerse.

Ohhh… After your filter_var suggestion… Immerse, now I see… that we are probably making our path to a validation (or sanitize better saying(and doing) perhaps) class interaction.

Ok… I’m less lost I believe.

Thank you,
Márcio

3

filter_input and filter_var are probably better suited for this (http://php.net/manual/en/function.filter-var.php).

And htmlentities() should only really be used when outputting data to the browser. Use filter_var et al for incoming data, mysql_real_escape_string et al (or prepared statements) for saving data and htmlentities for displaying.