Krdytkyu

I'm writing one custom class for PDO connection.

I want these advantages:

• Protect credentials: user, password ...


• Facilitate maintenance: facing future password changes for example


• Facilitate connection: $pdo=new MyPDO();
  


• Provide my class with all the PDO functionalities

I write my class as you can see here:

For protect credentials i saved them into a ini file:

<?php return; ?>

; credentials

host=localhost

user=myUser

pass="my/very/secure/password.../UqMsN[)VPn&gunmv3KzE?3Q&Qw/..."

dbname=myDataBase

The class

class MyPDO extends PDO

{



    public function __construct()

    {

        $iniData = parse_ini_file("//home/.credentials/db.php.ini");

        $host=$iniData["host"];

        $dbname=$iniData["dbname"];

        $user=$iniData["user"];

        $pass=$iniData["pass"];

        $dsn = "mysql:host=$host;dbname=$dbname";





        $options = array(

            PDO::ATTR_PERSISTENT => FALSE, 

            PDO::ATTR_EMULATE_PREPARES => FALSE, 

            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,

            PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'"

        );



        try {

                parent::__construct($dsn, $user, $pass, $options);

        } catch (PDOException $e) {

            error_log($this->error = $e->getMessage(),0);

        }

    }

}

?>

Usage example

include_once('MyPDO.php');

$pdo=new MyPDO();

/*Use any PDO method*/



$pdo->query(...);

$pdo->prepare(...);

$pdo->execute(...);

There are several areas for improvement.

• First of all, it violates the Liskov substitution principle. I am guilty for doing it too, so I cannot blame you too much but if you want your code to follow the best practices, it's better to make your class not extend PDO but either make a PDO instance a property of your class publicly accessible through a property or a method, or you can re-create in your class all the functionality supported by PDO.


• 
  

  Next, error reporting for the connection is rather inflexible. An exception is a precious thing that can be handled in many different ways, logging included. So I would rather re-throw a new exception, like

  
  
  

  try {
  
      parent::__construct($dsn, $user, $pass, $options);
  
  } catch (PDOException $e) {
  
      throw new PDOException($e->getMessage(), (int)$e->getCode());
  
  }
  
  

  
  
  

  so it can be caught elsewhere or simply logged if a corresponding PHP configuration directive says so.

  
  


• Connection encoding is better to be set in the DSN, as it's going to be more generic and supported by all drivers.


• reading the configuration right in the class violates the Single responsibility principle. I would make this class to accept an array of parameters, as to where these parameters are taken from - from .ini, .yml or .env file - is a distinct matter.


• And all the hassle related to protecting the configuration should be delegated elsewhere. After all, database credentials are not only settings that have to be protected - there are admin email, salt, API keys, etc.


• protecting an ini file adding .php as one of its extensions is too risky. it would work merely by accident. Why not to name it straight settings.php and thus make sure it will be always interpreted as PHP as long as it is called through a web-server with PHP support.


• I would also add a possibility to add/override the PDO options

So I would make your class

class DB

{

    protected $connection;

    public function __construct($config)

    {

        $dsn = "mysql:host=$config[host];dbname=$config[dbname];charset=$config[charset]";



        $options = array(

            PDO::ATTR_PERSISTENT => FALSE,

            PDO::ATTR_EMULATE_PREPARES => FALSE,

            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,

        );

        if (isset($config['options'])) {

            $options = array_merge($options, $config['options']);

        }



        try {

            $this->connection = new PDO ($dsn, $config['user'], $config['pass'], $options);

        } catch (PDOException $e) {

            throw new PDOException($e->getMessage(), (int)$e->getCode());

        }

    }

    public function conn() {

        return $this->connection;

    }

}

used as

$db = new DB($config);

$stmt = $db->conn()->query('SELECT * FROM users');