The document discusses how to use PHP frameworks like Doctrine and Smarty to rapidly develop complex relational web sites. It introduces these frameworks and how they help manage database connections, maintain relational integrity, and perform queries and transactions securely. The document provides an example of using Doctrine to access data across multiple tables with minimal programming and increased security compared to traditional PHP and SQL approaches.

1. Fast relational web site
construction with PHP
 Nelson Gomes (nelson.gomes@telecom.pt)
Team Leader
ZCE, ITIL Foundation V3, LPIC1-101
16th of November 2012

2. Talk Index
Introduction
Frameworks
Relational Database Model
Setting up
The 'Magic'
Queries
Transactions
Conclusion
Links
Q&A

3. Introduction
The purpose of this talk is to help web developers to take
advantage of some known PHP frameworks to develop
complex websites rapidly;
Although we're showing some specific frameworks in this
talk, other frameworks exist that do almost the same thing
or even better;
Just google the web and try out other frameworks and use
the ones you like the most;
The benefit of using these frameworks is to be more
productive, to use best pratices and to develop faster;

4. Introduction (cont.)
Developing complex sites with complex relational databases
can be very difficult without the right tools:
Manage Database Connections;
Maintaining Relational Integrity;
Performing Transactions;
Acessing data spread over several tables;
Updating, deleting and inserting records without loosing
integrity;

5. Introduction (cont.)
Example of how some developers still program:
mysql_query(“insert into customers (name, phone) values
('$name', '$phone');
When using many tables the developers need to create
methods to insert, update, delete and query records, this can
give a lot of work;
In this presentation, I'll try to show how to do all of this
with minimum programming...

6. Introduction (cont.)
Web site security depends greatly of the awareness
developers have for security issues;
Many PHP developers do bad code because don't know the
problems that can arise from bad programming:
SQL Injection;
Cross-Site Scripting;
Cross-Site Request Forgery;
(...)
Using these frameworks correctly reduce (some) security
vulnerabilities;

7. Introduction (cont.)
Other frameworks:
Propel;
Zend_Db;
Log4PHP;
Zend;
Symfony;
xAjax;
NuSOAP;

8. Frameworks
Introducing some PHP frameworks:
Doctrine – is a Object relational mapper that works on
top of PDO (PHP Data Objects);
Smarty – an engine for web templating in PHP;
MVC – (could use one MVC framework, but on this talk
won't use any);
You can easily change any of these frameworks with others
of your choice;

9. Frameworks (cont.)
Doctrine
With Doctrine you can use 'Code First', 'Model First' and
'Database First' approaches, meaning you start by
creating objects, UML or a database as a start point;
All doctrine queries are made using DQL – Doctrine
Query Language;
In this talk we'll go throught 'Database First' approach,
meaning Doctrine will look into the database and generate
code for it;
In this talk I'm using Doctrine 1.2.4, why?

10. Frameworks (cont.)
Advantages of using Doctrine:
Object Oriented Approach;
No need to rewrite code when switching database;
No need to keep track of identifiers of the inserted fields;
Object are written to database by Doctrine, no need to
SQL!
Associations are managed by Doctrine;
Database can be generated by our models (yaml, xml)

11. Frameworks (cont.)
Smarty
Is a template engine for PHP;
Allows separating design from code;
Eases the maintainability of on large web sites;
Allows reuse of templates;
Makes your website go faster;
Improves security;
Easily extensible;

12. Relational Database Model

13. Setting Up
Doctrine:
require_once BASE_DIR.'/lib/Doctrine­1.2.4/Doctrine.php';
spl_autoload_register(array('Doctrine', 'autoload'));
spl_autoload_register(array('Doctrine', 'modelsAutoload'));
$manager = Doctrine_Manager::getInstance();
$manager­>setAttribute(Doctrine::ATTR_MODEL_LOADING,
Doctrine::MODEL_LOADING_CONSERVATIVE);
$manager­>setCharset('utf8');
$manager­>connection('mysql://codebits:codebits@127.0.0.1/codebits');
if (DEBUGMODE)
Doctrine::generateModelsFromDb(dirname(__FILE__).'/models/');
Doctrine::loadModels(dirname(__FILE__).'/models/');

14. Setting Up (cont.)
Smarty:
require_once(BASE_DIR.'/lib/Smarty­3.1.12/libs/Smarty.class.php');
$smarty = new Smarty();
$smarty­>template_dir = dirname(__FILE__).'/lib/templates/';
$smarty­>compile_dir = dirname(__FILE__).'/lib/templates_c/';
$smarty­>config_dir = dirname(__FILE__).'/lib/configs/';
$smarty­>cache_dir = dirname(__FILE__).'/cache/';
$smarty­>compile_check=DEBUGMODE;

15. The 'Magic'
Folder models has been filled by Doctrine with code:
models/*.php (to fill with your business logic);
models/generated/*.php (object definitions);
Folder lib/templates_c/*.php has been filled by Smarty with
munged templates;
Now that the magic is working let's fill a web page with the
data we have in the tables!

16. The 'Magic'
Declaring table relations using hasMany, hasOne:
class Customers extends BaseCustomers {
public function setUp() {
$this­>hasMany('CustomerUsers as relatedUsers',
array(
'local'=>'id',
'foreign'=>'fk_customer_id',
)
);
(…)
}
}

17. The 'Magic'
Avoiding XSS in Smarty:
function escFilter($content,$smarty) {
return htmlspecialchars($content,ENT_QUOTES,UTF­8);
}
$smarty­>registerFilter('variable','escFilter');
To show unsafe content just explicitly do:
{$variable nofilter}
Doctrine manages strings avoiding SQL Injection attempts!
(but cannot do miracles!)

18. Transactions
But a good business layer only works well if it is
transactional, to maintain relational integrity.
$conn=Doctrine_Manager::connection();
try{
$conn­>beginTransaction();
$customer=new Customers();
$customer­>name=$name; (...)
$customer­>save();
$address=new Addresses();
$address­>fk_customer_id=$customer­>id; (...)
$address­>save();
 $conn­>commit();
} catch(Exception $ex) {
$conn­>rollback();
}

19. Queries
Any language or framework is secure depending on how
users use it:
static function updateCustomerName($name, $id) {
$conn=Doctrine_Manager::connection();
$conn­>execute(“update customers set name='$name' where id=$id”);
}
Bad pratice to concat any user input, use instead Doctrine
methods!
The above example can also be database dependant which
isn't a good practice.

20. Queries
Usind DQL:
static function getAllUserCustomers($id,$page=0){
return Doctrine_Query::create()
­>select('c.*')
­>from('Customers c')
­>where('c.relatedUsers.fk_customer_id=:userid',
array(':userid'=>$id))
­>orderBy('c.name')
­>limit(20)
­>offset($page*20)
#­>getSqlQuery();
­>execute();
}

21. Conclusion
In this demo:
We accessed data scattered over 7 different tables with
(almost) zero programming;
We didn't established or managed any connection;
Our application can be now easily converted to another
database engine with minimum effort;
Each page is only a couple of lines in size, no more
HTML embedding nightmares...;
Our application has become more secure;
In a couple of minutes...

22. Links
http://www.doctrine-project.org/
http://www.smarty.net/
http://logging.apache.org/log4php/
http://code.google.com/p/nusoap-for-php5/
http://www.zend.com/
http://www.xajaxproject.org/
(...)

23. Q&A
Thank You