An example of an MVC controller

Question

I have been reading a lot about how and why to use an MVC approach in an application. I have seen and understand examples of a Model, I have seen and understand examples of the View.... but I am STILL kind of fuzzy on the controller. I would really love to see a thorough enough example of a controller(s). (in PHP if possible, but any language will help)

Thank you.

PS: It would also be great if I could see an example of an index.php page, which decides which controller to use and how.

EDIT: I know what the job of the controller is, I just don't really understand how to accomplish this in OOP.

Solution 1

Request example

Put something like this in your index.php:

<?php

// Holds data like $baseUrl etc.
include 'config.php';

$requestUrl = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
$requestString = substr($requestUrl, strlen($baseUrl));

$urlParams = explode('/', $requestString);

// TODO: Consider security (see comments)
$controllerName = ucfirst(array_shift($urlParams)).'Controller';
$actionName = strtolower(array_shift($urlParams)).'Action';

// Here you should probably gather the rest as params

// Call the action
$controller = new $controllerName;
$controller->$actionName();

Really basic, but you get the idea... (I also didn't take care of loading the controller class, but I guess that can be done either via autoloading or you know how to do it.)

Simple controller example (controllers/login.php):

<?php    

class LoginController
{
    function loginAction()
    {
        $username = $this->request->get('username');
        $password = $this->request->get('password');

        $this->loadModel('users');
        if ($this->users->validate($username, $password))
        {
            $userData = $this->users->fetch($username);
            AuthStorage::save($username, $userData);
            $this->redirect('secret_area');
        }
        else
        {
            $this->view->message = 'Invalid login';
            $this->view->render('error');
        }
    }

    function logoutAction()
    {
        if (AuthStorage::logged())
        {
            AuthStorage::remove();
            $this->redirect('index');
        }
        else
        {
            $this->view->message = 'You are not logged in.';
            $this->view->render('error');
        }
    }
}

As you see, the controller takes care of the "flow" of the application - the so-called application logic. It does not take care about data storage and presentation. It rather gathers all the necessary data (depending on the current request) and assigns it to the view...

Note that this would not work with any framework I know, but I'm sure you know what the functions are supposed to do.

Solution 2

Imagine three screens in a UI, a screen where a user enters some search criteria, a screen where a list of summaries of matching records is displayed and a screen where, once a record is selected it is displayed for editing. There will be some logic relating to the initial search on the lines of

if search criteria are matched by no records
    redisplay criteria screen, with message saying "none found"
else if search criteria are matched by exactly one record
    display edit screen with chosen record
else (we have lots of records)
    display list screen with matching records

Where should that logic go? Not in the view or model surely? Hence this is the job of the controller. The controller would also be responsible for taking the criteria and invoking the Model method for the search.

Solution 3

<?php

class App {
    protected static $router;

    public static function getRouter() {
        return self::$router;
    }

    public static function run($uri) {
        self::$router = new Router($uri);

        //get controller class
        $controller_class = ucfirst(self::$router->getController()) . 'Controller';
        //get method
        $controller_method = strtolower((self::$router->getMethodPrefix() != "" ? self::$router->getMethodPrefix() . '_' : '') . self::$router->getAction());

        if(method_exists($controller_class, $controller_method)){
            $controller_obj = new $controller_class();
            $view_path = $controller_obj->$controller_method();

            $view_obj = new View($controller_obj->getData(), $view_path);
            $content = $view_obj->render();
        }else{
            throw new Exception("Called method does not exists!");
        }

        //layout
        $route_path = self::getRouter()->getRoute();
        $layout = ROOT . '/views/layout/' . $route_path . '.phtml';
        $layout_view_obj = new View(compact('content'), $layout);
        echo $layout_view_obj->render();
    }

    public static function redirect($uri){
        print("<script>window.location.href='{$uri}'</script>");
        exit();
    }
}

Comments

[keithjgrant]

+1 I've been reading & searching around on MVC a lot lately, and that (to me) is the clearest example of a controller I think I've seen yet.

[Kid Diamond]

Wouldn't the logoutAction belong in the LogoutController?

[Franz]

Or just think of it as AuthController. :)

[Kristoffer Bohmann]

It is critically important to note that this example does not consider security. The example is not implementing any encoding and special characters that leave the script open to attacks. Why? Because the script injects whatever is in the url ($_SERVER['REQUEST_URI']) into the PHP script. Nice and clear MVC controller example though.

[Franz]

Thanks for that remark, @KristofferBohmann. It's true that there's no extra validation of the URI (and the resulting controller and action name that we try to extract). But I see no "injection" going on here, or am I missing something?

[Kristoffer Bohmann]

$controllerName and $actionName are taking raw user-input + appending a word to the user-input. It is essentially the same as: $controllerName = ucfirst($_GET['controller']).'Controller'; and $actionName = strtolower($_GET['action']).'Action'; ... To be honest, I am unsure if this is a security issue. ... What I have in mind is to sanitize the user input with a function like this: function h($str) { return trim(stripslashes(htmlspecialchars($str, ENT_QUOTES, 'utf-8'))); } ... See also: OWASP on code injection.

[Franz]

Well, since we're only using it to build a class name, I guess the only thing is missing is some error handling in case the given file name cannot be found, right?

[Anthony Rutledge]

So, for 300 points, would my scribble satisfy your definition of a controller based (MVC) system? stackoverflow.com/questions/42172228/…

[djna]

@Anthony Rutledge I don't see a controller as I would recognise it here. Your Model has a method getView(), which to me implies that the model is undertaking some of the function of a controller in the MVC sense.

[timiTao]

adding some comment would help

[WoodrowShigeru]

With the model, view and controller having clear names, what would files like index.php from this example that start the whole shebang be called?

[Franz]

@WoodrowShigeru If they are the only publicly accessible PHP script (i.e. the "front controller"), then index.php is a good name, as it matches conventions / defaults of most webserver software.

[WoodrowShigeru]

Well, in my project I don't bottleneck it all over one file, and I'm not using request-routing either (for legacy reasons, among other things). So I've set up htaccess-rewrite rules to reach the many files that are like index.php; that call their own Controller class. But so far, I had them in the controllers/ dir – which I know understand is not what a controller is … I basically want to know how best to rename that dir.

[Franz]

If you're not doing any routing and just dispatching to the corresponding controller, I would just name them after the controller... But really, it's a bit hard to give good advice without seeing all the code.

[Krunal Pandya]

I used this code but I don't know why my index.php is not called. Any idea @Franz ?