PHP OOPs dynamic insert update delete data - php

Question

I am not very much familiar with the OOPs in PHP. Just getting some simple lessons from the net i have tried to make a class to dynamically insert,delete update , upload data from the form to the database tables...
I am not sure if it is really object oriented.. Anybody could help me locate the errors or just make it better....
To use this class...Here are some rules or necessity:
1. The fields in the form should have same name as that of the fields in database..
2. The name of 'Submit' button should be same as that of the TABLE the form is going to insert data into.
3. No field in form(table) should have a same name as that of ANY TABLE in database.(except submit button)
To insert use function INSERTDB..
and
If there is an image upload use IMAG...
Here's the code:
db.class.php
<?php class database{
var $user,$host,$pass,$db;
public function connect($user,$host,$pass,$db){
$this->user=$user;
$this->host=$host;
$this->pass=$pass;
$this->db=$db;
$this->mysqli=new mysqli($this->user,$this->host,$this->pass,$this->db);
if ($this->mysqli->connect_error) {
die('Error : ('. $this->mysqli->connect_errno .') '. $this->mysqli->connect_error);
}
}
function imag($path,$tb){
define ("MAX_SIZE","400");
$errors=0;
$imag =$_FILES["image"]["name"];
$j=date("Y.m.d");
$image=$j.$imag;
$uploadedfile = $_FILES['image']['tmp_name'];
if ($image)
{
$filename = stripslashes($_FILES['image']['name']);
$extension =substr($image,-3);
echo "<br>".$extension."<br>".$image;
$extension = strtolower($extension);
if (($extension != "jpg") && ($extension != "jpeg")
&& ($extension != "png") && ($extension != "gif"))
{
echo ' Unknown Image extension ';
$errors=1;
}
else
{
$size=filesize($_FILES['image']['tmp_name']);
if ($size > MAX_SIZE*1024)
{
echo "You have exceeded the size limit";
$errors=1;
}
if($extension=="jpg" || $extension=="jpeg" )
{
$uploadedfile = $_FILES['image']['tmp_name'];
$src = imagecreatefromjpeg($uploadedfile);
}
else if($extension=="png")
{
$uploadedfile = $_FILES['image']['tmp_name'];
$src = imagecreatefrompng($uploadedfile);
}
else
{
$src = imagecreatefromgif($uploadedfile);
}
list($width,$height)=getimagesize($uploadedfile);
$newwidth=800;
$newheight=($height/$width)*$newwidth;
$tmp=imagecreatetruecolor($newwidth,$newheight);
$newwidth1=150;
$newheight1=($height/$width)*$newwidth1;
$tmp1=imagecreatetruecolor($newwidth1,$newheight1);
imagecopyresampled($tmp,$src,0,0,0,0,$newwidth,$newheight,
$width,$height);
imagecopyresampled($tmp1,$src,0,0,0,0,$newwidth1,$newheight1,
$width,$height);
$filename = "../images/".$path."/". $image;
$filename1 = "../images/".$path."/s/". $image;
imagejpeg($tmp,$filename,100);
imagejpeg($tmp1,$filename1,100);
imagedestroy($src);
imagedestroy($tmp);
imagedestroy($tmp1);
}
}
//If no errors registred, print the success message
if(!$errors)
{
// mysql_query("update SQL statement ");
$this->insertdb($tb);
echo "Image Uploaded Successfully!";
}
}
function insert($tb,$field,$value){
$in= mysqli_query($this->mysqli,"INSERT INTO $tb ($field) values ($value)");
if(!$in){
die("Insert Query Failed" .mysqli_error($this->mysqli) );
}
}
function insertdb($tb){
echo $tb;
$f="";
$v="";
foreach($_POST as $key=>$value){
echo $key . " = " . $value. "<br>";
}
foreach($_POST as $key=>$value){
if(($key!==$tb)&&($key!=="image_y")){
$f=$f.mysqli_real_escape_string($this->mysqli,$key).",";
$v=$v."'".mysqli_real_escape_string($this->mysqli,$value)."',";
echo "<hr> there is no image<hr>";
}
if($key=="image_y"){
$f=$f."image,";
$v=$v."'".$_FILES['image']['name']."',";
echo "<hr> there is an image<hr>";
}
}
$f1=rtrim($f,",");
$v1=rtrim($v,",");
echo $f1 ."<br>".$v1;
$this->insert($tb,$f1,$v1);
}
function del($tb,$field,$value){
$d= mysqli_query($this->mysqli,"DELETE FROM $tb where $field = '$value' ");
if(!$d){
die("Delete Query Failed" );
}
}
function up($tb,$field,$value,$o_field,$o_value){
$u= mysqli_query($this->mysqli,"UPDATE $tb SET $field= '$value' where $o_field= '$o_value' ");
if(!$u){
die("Update Query Failed".mysqli_error($this->mysqli) );
}
}
function show($tb,$field,$value,$condition,$ans){
$s= mysqli_query($this->mysqli,"Select * from $tb where $field $condition '$value' ");
$s2=mysqli_fetch_assoc($s);
echo $s2[$ans];
if(!$s){
die("Select Query Failed".mysqli_error($this->mysqli) );
}
}
}
?>
process.php
<?php
include"../includes/db.class.php";
$o=new database();
$o->connect("localhost","root","","saycheese");
if(isset($_POST['category'])){
$tb="category";
$o->insertdb($tb);
}
if(isset($_POST['magzine'])){
$tb="magzine";
$o->insertdb($tb);
}
if(isset($_POST['writer'])){
$tb="writer";
$folder="wr";
$o->imag($folder,$tb);
}
if(isset($_POST['images'])){
$tb="images";
$folder="mag";
$o->imag($folder,$tb);
}
?>
`

Answer 1

Foreword
You're on the right track, but you're only half way there. you have to format your data before you can insert anything to the database.
This means, you must map your $_POST values to the the arrays $field and $value, the former being the database columns and the latter being the data you wish to insert.
The insert() method takes 3 inputs. $tb $field and $value
$tb is easy its a string. $field and $value are most likely arrays, depending on your table structure. even if your table contains a single column, it would still be best to use arrays. there are two syntax for working with arrays. the first being [] (only supported on newer php installations), and the older but more supported 'array()' method.
Addressing the problem
In your code, you are incorrectly using the insertdb method which is only for tables that have the same column name as post fields. otherwise, this method will not work. instead, you should focus on using the insert() method, and correctly mapping the values.
say you have a table structure like so
TABLE user_info
user_name (VARCHAR(25)
pass_word VARCHAR(255)
user_id PRIMARY, AI INT(11)
As you can see, for a successful insert, you must provide values for user_name and pass_word while user_id is your primary index and will autoincrement.
Now, say you have a post like so
$username = $_POST['user'];
$password = $_POST['pass'];
Knowing this, we have to somehow map this information to our database.
PRESTO! We can map them like so
$tb = 'user_info';
$field = ['user_name','pass_word'];
$value = [$username,$password];
now, we have all the prerequisites for inserting with our db class.
$o->insert($tb,$field,$value);

Answer 2

It's very messy at the moment. You need to abstract more to really make this OO. I would stick the connection stuff in another file and then turn this into a callable object.
What do I mean by this? Well, you can return the whole file as an object by returning $this in every function. For example, let's look at a where function.
//Db would hold your connection details and connect to the DB
class Query_Builder extends Db {
//Declare your instance variables here, we are just doing where for the purposes of this
protected $_where;
public function where($column, $field)
{
//Encaps in single quotes
$encapsField = '\'' . $field . '\'';
$newWhere = str_replace('?', $encapsField, $column);
$this->_where = 'WHERE ' . $newWhere;
return $this;
}
Note: You don't need public on the function, as it is declared implicitly anyway, but it is considered good practice to always declare functions explicitly.
This function will return $this->_where set to something like 'WHERE id = '1';'. Using this, you can build whole queries by repeating this process. This is a lot more object orientated and will give you good grounding to expand your class to incorporate these design patterns.