Making Login Library... Want some opinions

[Samishii23]

I know this isn't REALLY a question, but I also don't want to go to the PM area of the website and start sending random messages to members marked "Experts"...

I have been developing a Login Class library that i'll mostly use for my own projects, and because I want the experience. I haven't quite tested it out yet, though at the moment there are no run time errors. :P

But what I really would like is opinions of my code, insights about it. Maybe something should be done another way. Or w/e. Or features that could / should be added.

I'm eager to learn, and I would love some feedback on whether or not the code is good / bad.

[dlite922]

In my opinion, in your attempt to make this robust, you have forgotten the true meaning of OOP (classes and object). For example in a true OOP application logging would be assigned to a class of its own.

Also, with MVC architectures, you never, never...ever!...have HTML in your classes.

This looks like a class that really unique to your application. It's not generalized enough for use as the "free license" declaration in the header implies.

You should use mysqli prepare statements.

Final note: you should try using phpdoc-style comments/documentation. It's more standard and thus easier for a lot of other developers to read.

I didn't really review your logic or try to parse your code and look for security holes/hacks, so don't know if it's bullet proof.

Good first attempt! You'll only get better and better over time.

Cheers,

Dan

[Samishii23]

Thanks for the opinion!

I would hope I get better over time, seeing as I've been doing PHP / MySQL / HTML in my spare time for almost 7 years now. lol.

I recently got into the whole OOP when I was teaching myself C#, though as you said, I don't seem to know what I'm doing for that.

As for MVC Architectures. Never heard of them.

Guess its back to the drawing board, and doing some research.

Thanks again

[TheServant]

MVC is simply Model View Controller. It's one of the most accepted ways to separate your display and business logic.

I don't think it's back to the drawing board if it works. But in a revision you can rewrite it in a different structure (like MVC) which will make it easier to maintain, read, edit, share etc...

It is very difficult to make any code which can be used by anyone for a host of applications and is not too specific in the need/problem it addresses.

Best thing (as you said you were going to do) is use it for your applications at first and document any features you would like it to do and update it. Then if you ever put it online for others to use, you can field their suggestions in the same way.

[Dormilich]

You should use mysqli prepare statements.

… or PDO prepared statements (which IMO have the advantage that you can use all fetch modes (while MySQLi prepared statements only support one fetch mode))

[Samishii23]

@Dormilich, as I have only today begun looking into this type of queries, I think MySQLi would be a good starting point, and once I am accustomed with preparing statements, then I can move on to PDO.
Thank you for the reference. :)

[Dormilich]

one more appetizer for PDO: you can use the prepared statement directly in foreach().

$ps = $pdo->prepare(…);
$ps->bindValue(…);
$ps->execute();
 
foreach ($ps as $row)
{
	// do something with $row
}

[Samishii23]

@Dormilich, could I do the same thing with MySQLi? or is that PDO alone? I was wondering cause I've seen mysql->bind_results(); come up alot in my readings.
If I did not have to do the bind call, could I just do that foreach statement? Or is that only after something like a fetch_assoc() call or something?

[Dormilich]

you cannot directly use the MySQLi_Result or MySQLi_STMT classes in foreach() (compare it to DOMDocument (MySQLi) vs. SimpleXML (PDO)). however, if you do fetch_all() (not usable with prepared statements) you can loop over the resulting array. bind_result() only assigns variables to the (individual) results of the fetch operation (you still have to explicitly call fetch()* in a while() loop) so that you don’t have to work with a result/row array. what you cannot achieve is fetching results from a prepared statement into a class, as is possible in PDO.

in short, MySQLi requires explicit fetching. PDO not.

the only way around that is a custom DB class implementing either the Iterator or IteratorAggregate interface.

* - fetch() is the only method to get the results of a mysqli prepared statement!