I am trying to solve as many issues as possible with my Database Class and bind statements as far as possible without actually doing it in the front-end. The goal is to do all of the heaving lifting for PHP Developers and Web Designers as possible to make their job even more easier than other PHP frameworks.
The Database class is my main worry to make sure that I keep security with simplexity.
class Database {
// Instance of the Database and Error
private $db;
private $error;
private $stmt;
public function __construct () {
// Init the database connection
// Sets the connection type
$host = 'mysql:host' . $this->_hostname ';dbname' . $this->_database;
// Sets the connection options
$options = array(
PDO :: ATTR_PERSISTENT => TRUE ,
PDO::ATTR_ERRMODE => PDO:ERRMODE_EXCEPTION
);
try {
// Generates the Database connection of our class
this->db = new PDO($host, $this->_username, $this->_password, $options);
}
catch(PDOException $exception) {
// Catches all errors from the Database connection
$this->error = $exception->getMessage();
}
}
The instance of the Database is defined and called in __construct() to allow it to be called globally in other classes.
For queries to be done, I managed a small (secure?) work around in the form of functions
public function execute() {
// Executes our SQL query
return $this->stmt->execute();
}
public function results() {
// Returns all of the results from the table
$this->execute();
return $this->stmt->fetchAll(PDO::FETCH_ASSOC);
}
public function result () {
// Returns one of the results from the table
$this->execute();
return $this->stmt->fetch(PDO::FETCH_ASSOC);
}
With my knowledge, this is the most secure route of handling PDO and information unless I am wrong?
The other way, which seems to be more dangorious and common is to do $db->prepapre() and also db->execute() directly.
Am I handling the database class more securely than directly allowing the PDO built-in functions to do it directly in my class's code and pages?
