PHP MVC error handling, view display and user permissions

error handlingmvcpermissionsPHPview

I am building a moderation panel from scratch in a MVC approach and a lot of questions cropped up during development. I would like to hear from others how they handle these situations.

  1. Error handling

    Should you handle an error inside the class method or should the method return something anyway and you handle the error in controller? What about PDO exceptions, how to handle them? For example, let's say we have a method that returns true if the user exists in a table and false if he does not exist. What do you return in the catch statement? You can't just return false because then the controller assumes that everything is alright while the truth is that something must be seriously broken. Displaying the error from the method completely breaks the whole design. Maybe a page redirect inside the method?

  2. The proper way to show a view

    The controller right now looks something like this:

    include('view/header.php');
if ($_GET['m']=='something') include('view/something.php');
elseif ($_GET['m']=='somethingelse') include('view/somethingelse.php');
include('view/foter.php');

    Each view also checks if it was included from the index page to prevent it being accessed directly.
    There is a view file for each different document body. Is this way of including different views ok or is there a more proper way?

  3. Managing user rights

    Each user has his own rights, what he can see and what he can do. Which part of the system should verify that user has the permission to see the view, controller or view itself? Right now I do permission checks directly in the view because each view can contain several forms that require different permissions and I would need to make a seperate file for each of them if it was put in the controller.
    I also have to re-check for the permissions everytime a form is submitted because form data can be easily forged.
    The truth is, all this permission checking and validating the inputs just turns the controller into a huge if/then/else cluster.

    I feel like 90% of the time I am doing error checks/permissions/validations and very little of the actual logic. Is this normal even for popular frameworks?

Best Answer

There is no single proper approach to your problems even within MVC pattern so simple answer to your questions does not exist.

1 Error handling

If you are using the PDO you can change error handling by setting PDO::ATTR_ERRMODE so you don't have to use exceptions but regardless of the way errors are returned it is a programmers responsibility to handle them properly. If your method is returning false if the user doesn't exists then the controller should check what value was returned. There is no such thing as "controller assumes" it only means that the programmer assumed and didn't check returned value.

There are different errors which should be handled in different way some of them may require only showing error message some of them may be critical (like no db connection). You can use messages, views or additional controller to handle errors.

2 The proper way to show a view

Code from your example would be usually handled by the layout (header, footer, different element placement) and by the controller (using different views depending on the request). It is not good idea to use 'include' directly rather wrap it in the method. You can also create view class which would be responsible for handling views. view != .phtml

3 Managing user rights

In MVC pattern used for web applications there is usually additional "front controller" and permission checking will be handled there. You have to check for permission with each request and each request will require access to specific controller/method if you implement proper ACL it should resolve all your problems with user rights.

Related Topic