PHP和DB交互中的验证层

Question

In input of my application I have the following data: airplane_id , airport_id and passenger(s) details.

I need to make sure that selected airplane_id could reach airport_id . It might be done only with help a SQL query, but this checking is still a validation process, isn't it?

Validation should happen before I will save passenger(s) details.

In my application model, it is the ActiveRecord pattern object which represent a table. I would rather make Validator as a separated layer than to build it into the Model layer. But in this case I have an extra issue: usually Validators are general (their rules might be applied to any set of data). For instance is this data email? or IP? or date? etc.... but never mind what the data is. In my case, the mentioned rule won't be common at all; it will definitely be a specific rule, which can't be used by any other input data. So my question is: Is this checking still part of the validation process? And if yes, will Validator violate the S principle from the set of SOLID ?

Answer 1

It is validation and you should use a separate validation layer (single responsibility for input validation). Input validation isn't just data type checking, it can be much more complex. Model validation might still be needed though.

Think of input validation as whitelist validation (“accept known good”) and model validation as blacklist validation (“reject known bad”). Whitelist validation is more secure while blacklist validation prevents your model layer from being overly constrained to very specific use cases.

Invalid model data should always cause an exception to be thrown (otherwise the application can continue running without noticing the mistake) while invalid input values coming from external sources are not unexpected, but rather common (unless you got users that never make mistakes).

See also: https://lastzero.net/2015/11/form-validation-vs-model-validation/

Answer 2

Yes, these checks are validation.

Speaking from experience with a MVC pattern framework(Yii/2), I would say that you could make an abstract validator class and from there extend it into your concrete validators and call those validators from the model class. This will need a Model->validate() call, but having separate classes that actually check the data will not violate the S in SOLID , while Model->validate() will just loop through the validatos validate methods and store the error messages in an array.