Where object should be validated? - php

Question

My problem is that I don't know, witch solution for the validation of input is better and if there is another, better solution. Well, where object should be validated? On the one hand, the object should always be correct. On the other hand, if the user specifies several incorrect data, it's a more elegant solution to notify him of all errors, not just one (first occured).
// Solution 1:
try {
$user = new User();
$user->setFirstname($_POST['firstname']);
$user->setSecondname($_POST['secondname']);
$user->setLastname($_POST['lastname']);
$user->hasLeftHand($_POST['has-left-hand']);
$user->hasRightHand($_POST['has-right-hand']);
$user->setHandedness($_POST['handedness']);
$user->save($pdo);
} catch (Exception $e) {
echo $e->getMessage();
}
// Solution 2:
$user = new User();
$user->setFirstname($_POST['firstname']);
$user->setSecondname($_POST['secondname']);
$user->setLastname($_POST['lastname']);
$user->hasLeftHand($_POST['has-left-hand']);
$user->hasRightHand($_POST['has-right-hand']);
$user->setHandedness($_POST['handedness']);
$errors = $user->validate();
if (empty($errors)) {
$user->save($pdo);
} else {
echo 'Some errors occured: ' . implode(', ', $errors);
}
// Solution 3:
try {
$user = new User();
$user->setFirstname($_POST['firstname']);
$user->setSecondname($_POST['secondname']);
$user->setLastname($_POST['lastname']);
$user->hasLeftHand($_POST['has-left-hand']);
$user->hasRightHand($_POST['has-right-hand']);
$user->setHandedness($_POST['handedness']);
$user->save($pdo);
} catch (Exception $e) {
$errors = $user->validate();
echo 'Some errors occured: ' . implode(', ', $errors);
}
In solution 1 each set method validates the input. Therefore, the object is always correct. The save method only saves the object in the database. On the other hand, if all the data is incorrect, it will be displayed only the first error.
In solution 2 we allow that object can not be correct between set calls, but to the database can be saved only valid object. set methods do not validate the input. validate method validates the object as a whole, and returns a list of all errors found. save method looks like this:
public function save(PDO $pdo)
{
if(! empty($this->validate())) {
throw new Exception('Invalid state');
}
// Store in database
}
In this solution is easier to validate the object. Becouse, how should work code below in solution 1?
$user->hasLeftHand(true);
$user->hasRightHand(false);
$user->setHandedness('right');
Or this code:
$user->setHandedness('right');
$user->hasLeftHand(true);
$user->hasRightHand(false);
Solution 3 is a copy of solution 2. Code of User class is the same. Changes only its use - try-catch block. In my opinion, this code looks more clearly.

Answer 1

Validation of input should be separated from validating the correctness of a domain object itself. Many frameworks use Form classes for this. Maybe have a look at how it's done in:
Symfony
Zend Framework (Form InputFilters)
In short, the form will validate the input, and will populate a bound object in case the data is valid.
disclaimer: this question is opinion based, and there is no 1 correct answer... but I'll true to recap what we discussed in comments and how I think most people solve it.
separate input validation from the model
<?php
// class for input validation
class UserValidator
{
public function validate(array $data)
{
$errors = array();
if (isset($data['email'])) {
if (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
$errors['email'] = 'email not valid';
}
} else {
$errors['email'] = 'email is required';
}
}
}
// model class itself, does not implement extensive validation
class User
{
protected $email;
public function setEmail($email)
{
// only make sure we have a valid string, dont validate email again
if (!is_string($email) || !strlen($email)) throw new \InvalidArgumentException('invalid email given');
$this->email = $email;
return $this;
}
}
So this example separates the input validation so it is easy to provide user feedback when processing form data. The model itself only performs basic checks, and assumes the developer is smart enough to set sane data...
<?php
// where you process a form POST...
$validator = new UserValidator();
$errors = $validator->validate($_POST);
if (count($errors)) {
// provide feedback to your user, he gave us bogus data...
return $errors;
}
// if we are here, we passed validation and can assume our data is good
$user = new User();
$user->setEmail($_POST['email']);
This is a very simplified example, again you should check out how the major frameworks solve this problem, they've had many people thinking hard about this already...
And as the differences between Zend and Symfony underline: there is no golden hammer for this.