Attaching objects in request object with PHP

Question

I have seen several instances of this question but did not get a clear answer. Here is my scenario

1. I have a form on login.php - this should submit to loginController.php
2. Once loginController.php validates against the databse, it should either redirect to home.php or pass back to login.php with appropriate success / error messages
3. I know I can pass information back-forth between pages using SESSION but I would rather avoid using SESSION for just messages and objects that are page specific.

In JAVA we can embed objects into request object and then forward the control to the next page. Is there something equivalent in PHP?

The way I am doing it at present is as below -

1.loginController.php has the main page and it includes login.php

2.login.php resubmits the data back to loginController.php (sorta recursive submit)

3.Then there is if-then-else logic to determine whether next redirect needs to go to home.php or just include login.php once again with error messages

Answer 1

From our discussion, I think the following snippet may do what you want. You can use $_SESSION variable to store user data and $_POST variable to discriminate if user has submitted username and password data:

Login Controller

/* Already logged in */
if(isset($_SESSION['username'])
{
    header('Location:home.html');
}

/* Not logged in */
else 
{
    /* Login submitted */
    if(isset($_POST['submit']))
    {
        $user = new User(); // this is an instance of model class
        $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
        $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING);

        $login_result = $user->login($username, $password);

        /* Login success */
        if($login_result == true)
        {
            $_SESSION['username'] = $username;
            header('Location:home.html');
        }

        /* Login error */
        else
        {
            $view_data = "Login incorrect"; // here you can set some data to be shown on login view
            showView('login.html'); // pseudo code, change with your code to show login view
        }
    }

    /* Show login form */
    else
    {
        showView('login.html'); // pseudo code, change with your code to show login view
    }
}

Login view

<?php if(!empty($view_data)) echo $view_data; /* Here you show login result (i.e. errors) */ ?>

<form method="post" action="login.html">
    <input type="text" id="username" name="username" placeholder="Username" />
    <input type="password" id="password" name="password" placeholder="Password" />
    <input type="submit" name="submit" value="Login" />
</form>

Of course, you must implement $user->login method on user model (I strongly suggest you to use PDO statements to query database). This method simply checks user data and returns true on login success and false on failure.

On logout, simply unset($_SESSION['username']) and you're done.

I also suggest you to have a look on something like this session security question, to protect your session against hijacks. Hope it helps.

Answer 2

You can use query strings.

when you redirect to login.php as a result of an error, your full url will be something like:

login.php?status=error&message=invalid_credentials

in your login.php,

you can access the extra information as follows

$_GET['status'];//will contain the status
$_GET['message'];//will contain the message

Cheers!