1

Something which is made for security purpose and encapsulation that we have the Public,Private, Protected classes but one question is still struck in the mind that what is the mean of that if we still can access or know those all the members of class whatever it is Public, Private or Protected??

For Example :

<?php

 class GrandPas   // The Grandfather's class
  {
   public     $name1 = 'Mark Henry';  // This grandpa is mapped to a public modifier
   protected  $name2 = 'John Clash';  // This grandpa is mapped to a protected  modifier
   private    $name3 = 'Will Jones';  // This grandpa is mapped to a private modifier
  }
#Scenario: Using reflection

$granpa = new ReflectionClass('GrandPas'); // Pass the Grandpas class as the input for the Reflection class
$granpaNames=$granpa->getDefaultProperties(); // Gets all the properties of the Grandpas class (Even though it is a protected or private)



 echo "Printing members the 'reflect' way..<br>";

 foreach($granpaNames as $k=>$v)
  {
    echo "The name of grandpa is $v and he resides in the variable $k<br>";
  }

the output will be:

#Scenario Using reflection
Printing members the 'reflect' way..
The name of grandpa is Mark Henry and he resides in the variable name1
The name of grandpa is John Clash and he resides in the variable name2
The name of grandpa is Will Jones and he resides in the variable name3

As we can see the all members of the class whether its Private, Protected or Public. So what is the concept of OOP here?

PS: Example take from Shankar Damodaran.

Sudhanshu Saxena
  • 1,199
  • 12
  • 32
  • "Reflection is often used as part of software testing, such as for the runtime creation/instantiation of mock objects." From [wikipedia](https://en.wikipedia.org/wiki/Reflection_(computer_programming)). – vascowhite Jul 23 '14 at 06:13
  • Designing classes that later for sure will be used via reflection is not a way of design. You use reflection on the class for the purpose of your own application, e.g. a test suit, not the opposite. – Royal Bg Jul 23 '14 at 06:15
  • 2
    You say they're for “security purpose”s, but they aren't. Access specifiers are designed to prevent you from doing something stupid on accident, not to provide any measure of security against a determined attacker. – Waleed Khan Jul 23 '14 at 06:16
  • 2
    I need to agree with @WaleedKhan ... anyone that can instantiate your class, already has its source and know about its properties – Royal Bg Jul 23 '14 at 06:17
  • then why we use `protected or private` if we have the class access – Sudhanshu Saxena Jul 23 '14 at 06:34
  • 1
    for purpose of good design, good looking code and later reuse. Using public is bad. Imagine you have `public $x` in your class. Later in your application you do `echo $yourClassObject->x`. Later you go to this class and change `$x` to `$y`. The echo, then, doesn't work. That's why for instance introducing accessors and setting the field private is the better practice – Royal Bg Jul 23 '14 at 06:41
  • @RoyalBg yeah thats pretty clear answer for this, thanks for clearing my huge misconception about this. – Sudhanshu Saxena Jul 23 '14 at 06:44

2 Answers2

6

TL;DR;

If you can do something - that does not mean you should do it

Reflection

That's the thing which is intended to provide meta-information about entities, but real use-case for it is debatable and almost always it can be replaced with something. The point is not to tell that it's bad, but to tell - if you want to use that in your architecture, then probably, you have a flaw in it.

A way to "go"..

Actually, you can access protected/private properties in PHP without using Reflection. For instance, Closure::bindTo() like:

class Test
{
   private $x = 'foo';
}

$z = new Test();

$y = function()
{
   return $this->x;
};
$y = $y->bindTo($z, $z);

echo $y(); //foo

And.. so what? Each language feature may be used for good or bad. That we're calling "good practices" and "bad practices" (well, to be honest, it's hard for me to remember "good practices" for such things as global in PHP, but that's out of this question). More, in PHP there are so many thins which you can use in wrong way - that it makes it difficult language - in the sense, that it's not hard to learn the language, but it's hard to use all it's features properly, because that requires solid architecture & good practices knowledge.

You may imagine a way to access hidden properties with even such thins as var_dump() + ob_ functions - but that will only illustrate how horrible may be using of some decent feature.

And how to deal with it

Do not use Reflection in such way. And certainly don't count on this when building your architecture. It's not the thing for which it should be used. And if you want to access your properties from outside - then - fine, declare them as public.

Just use things properly. It's the only way to go. And if you don't know what is the proper usage - then learn. It's the thing we're always doing. Each day.

Alma Do
  • 37,009
  • 9
  • 76
  • 105
3

The public, protected and private tokens are meant to define visibility for properties, it's not meant to provide security in any way.

Visibility is used to distinguish between:

  1. your public interface,
  2. the interface exposed to class extensions, or,
  3. internal state.

Reflection is primarily meant as an aid to provide goodies such as AOP, DIC, proxies, etc.; specifically, it's not meant as a hacker's tool. Someone using your code can simply read it to get what they want, nay, edit it for their own "evil" purposes.

Ja͢ck
  • 170,779
  • 38
  • 263
  • 309
  • then there is a misconception about `public` `private` or `protected` among the OOP concept that its mainly used for security purpose. – Sudhanshu Saxena Jul 23 '14 at 06:37
  • 1
    @SudhanshuSaxena I'd be interested to know which article mentions such a thing; they're clearly advocating the wrong idea :) – Ja͢ck Jul 23 '14 at 06:38
  • Moreover, many documentation generators provide an option to hide private fields and methods. This is good for making public API documentation with only `public` methods fields and classes. – Ion Bazan Jul 23 '14 at 06:39
  • @janek2012 Right, that's an example of how visibility can be useful as well :) – Ja͢ck Jul 23 '14 at 06:40
  • 1
    I would also add, that reflection is used in DI container implementations (to analyze the class' constructor), which do not relay on configuration. – tereško Jul 23 '14 at 07:18