problems with validating input and query optimization - php

Question

im creating a management system where teachers can manage students final projects and the formers can see what other students created
im a laravel newbie and im having problems optimizing queries and validating urls
here are my table schemas:
Cursos
+-------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-------+------------------+------+-----+---------+----------------+
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| curso | varchar(255) | NO | | NULL | |
+-------+------------------+------+-----+---------+----------------+
Trienios
+--------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------------+------------------+------+-----+---------+----------------+
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| data_trienio | varchar(255) | NO | | NULL | |
| curso_id | int(11) | NO | | NULL | |
| oe_id | int(11) | NO | | NULL | |
+--------------+------------------+------+-----+---------+----------------+
Alunos
+------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+------------+------------------+------+-----+---------+----------------+
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| id_cartao | int(10) unsigned | NO | UNI | NULL | |
| nome | varchar(255) | NO | | NULL | |
| email | varchar(255) | NO | UNI | NULL | |
| trienio_id | int(11) | NO | | NULL | |
+------------+------------------+------+-----+---------+----------------+
PAP
+-----------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-----------+------------------+------+-----+---------+----------------+
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| nome | varchar(255) | NO | | NULL | |
| descricao | text | NO | | NULL | |
| nota | int(11) | NO | | NULL | |
| aluno_id | int(11) | NO | | NULL | |
+-----------+------------------+------+-----+---------+----------------+
so far i've managed to set up dynamic urls based on the records defined on the cursos and trienios table, like this: http://localhost:8000/TGEI/2014-2017
(TGEI being a record in the cursos table that fetches the associated trienio records and 2014-2017 being a record in the trienios table that's related to a curso record in a 1-to-many relationship and fetches the related pap records)
this is all working nice and smooth, but i'm having trouble with optimizing hugely inefficient queries that will become a very significant problem when the database grows
here are my relationships:
Curso.php
public function trienio()
{
return $this->hasMany('App\Trienio');
}
Trienio.php
public function curso()
{
return $this->belongsTo('App\Curso');
}
public function oe()
{
return $this->belongsTo('App\OE');
}
public function aluno()
{
return $this->hasMany('App\Aluno');
}
Aluno.php
public function trienio()
{
return $this->belongsTo('App\Trienio');
}
public function pap()
{
return $this->hasOne('App\PAP');
}
PAP.php
protected $table = 'pap';
public function aluno()
{
return $this->belongsTo('App\Aluno');
}
and these are the controllers that are in charge of serving the user-accessible pages:
CursoController.php
public function index(Curso $curso)
{
$cursos = $curso->all();
return view('curso')->withCursos($cursos);
}
TrienioController.php
public function index(Trienio $trienio, $curso)
{
$trienios = $trienio->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
})->get();
return view('trienio')->withTrienios($trienios);
}
PapController.php
public function index(Pap $pap, $curso, $trienio)
{
$pap = $pap->whereHas('aluno.trienio', function ($query) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
});
})->toSql();
dd($pap);
return view('pap')->withPap($pap);
}
public function show(Pap $pap, $curso, $trienio, $id)
{
$pap = $pap->find($id);
dd($pap);
return view('show')->withPap($pap);
}
as you can see, in the case of the index method of the PAP controller, the query that requests the data is a huge mess that is the epitome of the n+1 problem:
"select * from `pap` where exists (select * from `alunos` where `pap`.`aluno_id` = `alunos`.`id` and exists (select * from `trienios` where `alunos`.`trienio_id` = `trienios`.`id` and `data_trienio` = ? and exists (select * from `cursos` where `trienios`.`curso_id` = `cursos`.`id` and `curso` = ?)))"
what i intend with this query is to fetch the PAP records that are related to a trienio record, which in turn is related to a curso record, based on the input the user enters in the url (i've shown an example above), the problem is, as i'm a newbie to this stuff in general, i was unable to apply the eager loading concepts to the query i want to run
also i'm having a problem with validating urls in which the user can input the following:
http://localhost:8000/qwfkjnfwq/qjqtikjn/1
and the controller method show will fetch a pap record without regard to the parameters that the user inputed 2 levels above, and this obviously will pose a "security" problem
and what i wanted to do was:
http://localhost:8000/TGEI/2014-2017/1
the controller method show will load the aluno.trienio nested relationship, then fetch the trienio id related to the aluno model in accordance to the 2014-2017 parameter, then fetch the curso id related to the trienio model in accordance to the TGEI parameter
and so, stuff like this
http://localhost:8000/qwfkjnfwq/qjqtikjn/1
would be invalidated instead of going through.
this may be a tricky question but whoever that can help me, i would thank so. i understand that some parts of my question may be unclear(even more so because english isnt my first language) and in that case, i can clarify them all you want.
and for better information, here is my web.php file
Route::get('/', 'CursoController#index');
Route::get('/{curso}', 'TrienioController#index');
Route::get('/{curso}/{trienio}', 'PapController#index');
Route::get('/{curso}/{trienio}/{id}', 'PapController#show');

Answer 1

Okay to expand on my comment.
With Laravel 5.2 came route model binding which enables you to inject the model in the controller method (like this: public function show(Pap $pap)) and Laravel will automatically fetch the Pap model with the id in the url (bascially doing Pap::find($id) and saving the return into $pap variable). This is not always something you want, because often you want to perform more complex queries.
I would recommend you not to use the route model binding in you case and just do the queries on your own. Something like this (see how I've removed the Models from controller functions)
// CursoController.php
public function index()
{
$cursos = Curso::all();
return view('curso')->withCursos($cursos);
}
// TrienioController.php
public function index($curso)
{
$trienios = Trienio::whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
})->get();
return view('trienio')->withTrienios($trienios);
}
// Pap controller
public function index($curso, $trienio)
{
$pap = Pap::whereHas('aluno.trienio', function ($query) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
});
})->get();
return view('pap')->withPap($pap);
}
public function show($curso, $trienio, $id)
{
$pap = Pap::whereHas('aluno.trienio', function ($query) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
});
})->findOrFail($id);
return view('show')->withPap($pap);
}
Also note that in the show() method I've pretty much copied the index() query which is the validation.
And regarding the optimization of queries - the queries as you have them are absolutely fine. There's no n+1 problem as is.
You will have the n+1 problem if you will be performing a foreach on one of the index results and calling child's properties. For example if you will do something like this in a pap view:
#foreach($pap as $p)
<div>{{ $p->aluno->id }}</div>
#endforeach
This would make a new query for every $p in $pap to fetch the related aluno results.
To avoid this n+1 problem you have to load the data before using it in a loop. You would eager load the data using the ->with(relationship) method. Something like this:
// Pap controller
public function index($curso, $trienio)
{
$pap = Pap::whereHas('aluno.trienio', function ($query) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
});
})
->with('aluno.trienio') // You might need some additional checks here, depending on you needs
->get();
return view('pap')->withPap($pap);
}
It's not completely intuitive, but ->whereHas(relationship) will not eager load the relationship. So often you will find yourself writing statement like this:
// Pap controller
public function index($curso, $trienio)
{
$pap = Pap::whereHas('aluno.trienio', function ($query) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
});
})
->with(['aluno.trienio' => function ($q) use ($curso, $trienio) {
$query->where('data_trienio', '=', $trienio)->whereHas('curso', function ($query) use ($curso) {
$query->where('curso', '=', $curso);
}]); // These are the additional checks
->get();
return view('pap')->withPap($pap);
}