# How to create iCRUD

**URL:** <https://www.phphelp.com/t/how-to-create-icrud/23706>\
**Category:** Code Snippets\
**Created:** [November 24, 2014, 3:05pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706 "2014-11-24T15:05:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Strider64](https://www.phphelp.com/user_avatar/www.phphelp.com/strider64/32/3161_2.png) [@Strider64](https://www.phphelp.com/u/Strider64)\
**Post date:** [November 24, 2014, 3:05pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/1 "2014-11-24T15:05:52Z")

</div>

The following just shows how to create a basic interface that Creates, Updates, Reads and Deletes. This is obviously done in Object-Oriented Programming style and is still a work-in-progress for me. However, there are benefits in creating an interface for one it is extremely portable, easy to use and easy to maintain. Two it keeps your code structured and forces you to stay structured.

Here is the interface:

```auto
<?php
/* The iCrud interface.
 * The interface identifies four methods:
 * - create()
 * - read()
 * - update()
 * - delete()
 */
interface iCrud {

  public function create($data);

  public function read();

  public function update($data);

  public function delete($id=NULL);
  
}
[/php]

I think that is pretty straight forward and really hardly any explanation is needed. 

This is how I implement the interface for my blog/forum(s).
[php]<?php

class OnlineJournal implements iCrud {
  
  protected $query = NULL;
  protected $stmt = NULL;
  protected $result = NULL;
  protected $query_params = NULL;
  protected $row = NULL;
  protected $status_message = NULL;
  protected $category = 'home_page';

  public function __construct(array $data = NULL) {
    if (is_array($data) && !empty($data['title']) && !empty($data['message_post'])) {
      $db = Database::getInstance();
      $pdo = $db->getConnection();

      /* Set the query variable */
      $this->query = 'INSERT INTO blog (category, client_id, created_by, title, message_post, date_added) VALUES (:category, :client_id, :created_by, :title, :message_post, NOW())';

      /* Set the query variable */
      $this->stmt = $pdo->prepare($this->query);

      /* Execute the Query */
      $this->result = $this->stmt->execute(array(':category' => $this->category, ':client_id' => $data['client_id'], ':created_by' => $data['created_by'], ':title' => $data['title'], ':message_post' => $data['message_post']));

      return 'Data Successfully Inserted!';
    }
  }

  public function create($data) {
    return self::__construct($data);
  }

  public function setCategory($category) {
    $this->category = $category;
  }
  
  public function getCategory() {
    return $this->category;
  }

  public function read() {
    $db = Database::getInstance();
    $pdo = $db->getConnection();
    $this->query = 'SELECT id, client_id, created_by, title, message_post, date_updated, DATE_FORMAT(date_added, "%M %e, %Y") as date_added FROM blog WHERE category=:category ORDER BY date_updated ASC';
    $this->stmt = $pdo->prepare($this->query);
    $this->stmt->execute([':category' => $this->category]);
    if ($this->stmt && $this->stmt->rowCount() > 0) {
      return $this->stmt; // if there is data in the database table then return:
    } else {
     return FALSE;
    }
  }

  public function update($data) {

    $db = Database::getInstance();
    $pdo = $db->getConnection();
    /* Update the edited blog */
    $this->query = 'UPDATE blog SET title=:title, message_post=:message_post, date_updated=NOW() WHERE id=:id';
    /* Prepare the statement */
    $this->stmt = $pdo->prepare($this->query);
    /* Execute the statement */
    $this->result = $this->stmt->execute(array(':title' => $data['title'], ':message_post' => $data['message_post'], ':id' => $data['id']));

    return ($this->result) ? true : false;
  }

  public function delete($id = NULL) {
    $db = Database::getInstance();
    $pdo = $db->getConnection();
    $this->stmt = $pdo->prepare('DELETE FROM blog WHERE id=:id');
    $this->result = $this->stmt->execute(array(':id' => $id));
    return ($this->result) ? true : false;
  }

}

```

This is how new data is inserted into the database table:

```auto
<?php
require 'lib/includes/utilities.inc.php';
if (!$user) {
  header("Location: forums.php");
  exit();
} elseif ($user->getSecurityLevel() == 'public') {
  header("Location: forums.php");
  exit();
}
$category = $_SESSION['category']; // Retreive the category in order to set:
$newThread = new OnlineJournal(); // Create a new instance of C.R.U.D. system:
$newThread->setCategory($category); // Set Category for proper forum:

/* Insert blog into database table */
$journal = filter_input(INPUT_POST, 'submitBlog', FILTER_SANITIZE_SPECIAL_CHARS);

if (isset($journal) && $journal == 'Enter') {
  $data['client_id'] = filter_input(INPUT_POST, 'client_id', FILTER_SANITIZE_NUMBER_INT);
  $data['created_by'] = filter_input(INPUT_POST, 'created_by', FILTER_SANITIZE_SPECIAL_CHARS);
  $data['title'] = filter_input(INPUT_POST, 'title', FILTER_DEFAULT);
  $data['message_post'] = filter_input(INPUT_POST, 'message_post', FILTER_DEFAULT);
  $message = $newThread->create($data); // insert data into database table:
  unset($journal);
}
include 'lib/includes/header.inc.php';
?>
<div class="container blogContainer">
  <div class="blogFormContainer">
    <form id="" class="blogFormStyle m-span5" action="<?php echo $phpSelf ?>" method="post"> 
      <fieldset class="fieldsetStyle">
        <legend class="legendStyle">Insert Blog</legend>
        <input type="hidden" name="update_id" value="">
        <input type="hidden" name="client_id" value="<?php echo $user->getUserId(); ?>">
        <input type="hidden" name="created_by" value="<?php echo $user->getFirstName() . ' ' . $user->getLastName(); ?>">
        <input id="title" type="text" name="title" placeholder="Title Goes Here..." value="">
        <textarea id="message_post" placeholder="Blog Text Goes Here..." name="message_post"></textarea>
        <input class="blogBtn" type="submit" name="submitBlog" value="Enter"> 
        <button class="blogBtn" name="reset" >Cancel</button>
      </fieldset>
    </form>
  </div>  
</div>
<?php
include 'lib/includes/footer.inc.php';

```

I think it’s pretty straight forward and like I said it’s still a work-in-progress meaning there’s still some data validation that needs to be performed on the scripts. However, I think if you know OOP then that should be a walk-in-the-park for you. 😉

---

<div class="post-metadata">

**Author:** ![grwebugy](https://www.phphelp.com/user_avatar/www.phphelp.com/grwebugy/32/1076_2.png) [@grwebugy](https://www.phphelp.com/u/grwebugy)\
**Post date:** [November 29, 2014, 3:02pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/2 "2014-11-29T15:02:55Z")

</div>

Good start!

I like that your example includes filtering input.

---

<div class="post-metadata">

**Author:** ![JimL](https://www.phphelp.com/user_avatar/www.phphelp.com/jiml/32/1842_2.png) [@JimL](https://www.phphelp.com/u/JimL)\
**Post date:** [November 30, 2014, 3:55pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/3 "2014-11-30T15:55:52Z")

</div>

> [@grwebguy](#):
>
> Good start!
> 
> I like that your example includes filtering input.

Good start indeed, but why are we filtering input? I always prefer to store the actual data the user have submitted, without any escaping or filters done to it. Makes it much easier to avoid double escaping or other problems later on.

---

<div class="post-metadata">

**Author:** ![Strider64](https://www.phphelp.com/user_avatar/www.phphelp.com/strider64/32/3161_2.png) [@Strider64](https://www.phphelp.com/u/Strider64)\
**Post date:** [November 30, 2014, 4:38pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/4 "2014-11-30T16:38:19Z")

</div>

> [@JimL](#):
>
> Good start indeed, but why are we filtering input? I always prefer to store the actual data the user have submitted, without any escaping or filters done to it. Makes it much easier to avoid double escaping or other problems later on.

Actually I had another post on this subject on how I spent 4 hours trying to figure why my code was acting up, I meant to change this.

I just do this now for example.  
[php] $content = $badWordFilter-\>setText(filter\_input(INPUT\_POST, ‘message\_post’, FILTER\_DEFAULT));[/php]

It really doesn’t filter the input, but I guess it “might” catch something really crazy (but I doubt it).An according to [PHP.NET](http://PHP.NET) - “ID of default (“string”) filter. This is equivalent to FILTER\_UNSAFE\_RAW.”. I liken it to passing water through a tube unfiltered. It doesn’t catch html special characters or HTML (I know for I have tested myself). That I leave to the output with htmlspecialchars and the like. 😉 I just do the above now to get my IDE (NetBeans) from warning me about “unfiltering” $\_POST (It annoys me seeing warning symbols on the side). LOL ;D

---

<div class="post-metadata">

**Author:** ![benanamen](https://www.phphelp.com/user_avatar/www.phphelp.com/benanamen/32/287_2.png) [@benanamen](https://www.phphelp.com/u/benanamen)\
**Post date:** [November 30, 2014, 5:25pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/5 "2014-11-30T17:25:42Z")

</div>

I am of the garbage in garbage out school of thought. Therefore I clean my data going in.

---

<div class="post-metadata">

**Author:** ![JimL](https://www.phphelp.com/user_avatar/www.phphelp.com/jiml/32/1842_2.png) [@JimL](https://www.phphelp.com/u/JimL)\
**Post date:** [November 30, 2014, 5:48pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/6 "2014-11-30T17:48:21Z")

</div>

Fair enough, but I still wouldn’t recommend it

This page explain it pretty well  
[http://lukeplant.me.uk/blog/posts/why-escape-on-input-is-a-bad-idea/](http://lukeplant.me.uk/blog/posts/why-escape-on-input-is-a-bad-idea/)

Other than that, just google “escape input or output”

> <https://security.stackexchange.com/questions/42498/which-is-the-best-way-to-sanitize-user-input-in-php>

  

> <https://stackoverflow.com/questions/3936774/output-or-input-filtering>

I see no good reason to change the users data when storing it in the database, at all.

---

<div class="post-metadata">

**Author:** ![benanamen](https://www.phphelp.com/user_avatar/www.phphelp.com/benanamen/32/287_2.png) [@benanamen](https://www.phphelp.com/u/benanamen)\
**Post date:** [November 30, 2014, 8:20pm UTC](https://www.phphelp.com/t/how-to-create-icrud/23706/7 "2014-11-30T20:20:44Z")

</div>

Being open to improving my skills, I am looking into it.