In his talk, “Writing Viruses for Fun, Not Profit,”Ben Dechrai (after making the viewer take a pledge to only use this knowledge for good and not evil) walks through how many viruses operate, and just how easy it is to build your own self-replicating virus in PHP.

The danger of many of these viruses according to Ben is that the most dangerous viruses often escape detection by not looking like a virus. Instead they encrypt their code to hide their true intent, while also constantly adapting and evolving.

Perhaps even more dangerously, they act like they’re benign and don’t actually do anything - often times laying dormant until called upon by the malicious actor.

Creating the Virus

What’s scary is just how simple it was for Ben to create such a virus, one that mutated ever so slightly as it infected every other file on the server. Opening up unlimited possibilities from scraping customer data, to DDOS attacks, to simply hijacking your domain.



But those attacks are just the start as Ben demonstrated how easy it is to write new files, delete files, eval() and execute foreign code - which could even be extended to accessing the underlying server itself if shell_exec() is enabled.

To add to the problem, Ben shares how challenging it can be to identify malicious code on your server as many of these attacks are far more sophisticated than the the virus he created in a matter of minutes - hiding themselves and often appearing as if they are part of the original source code.

Deploying the Virus

To drive his point home, Ben demonstrates how even seemingly secure systems can be vulnerable - as all it takes is one tiny misstep within your application.

He highlights this by building what should be a secure photo gallery - one that checks the extension and mime-type of the image - and even stores it outside of the public directory. He goes even farther by adding additional sanity checks with a PHP script that then renders the image.

After walking through the code and it’s security features, he then downloads a simple image from the internet. Opening his editor he quickly injects the virus (written in PHP) into the image and uploads it, passing all of the server checks.

Surely, since it passed these checks the system is secure, right? Ben loads the gallery to proudly show off the image - which is just that… an image, with nothing special or out of the ordinary.
Except that when he opens the image gallery files, each has been infected with the malicious code.

The culprit that allowed for Ben to hijack an entire system and execute foreign code, create new files, and even hijack the entire site? When displaying the image the file was included using PHP’s include() function, instead of pulling in the data using file_get_contents() and echoing it out.

Such a simple mistake provided Ben, if he was a malicious hacker, complete access to all of the files on the system.

Protecting Yourself

Security always exists in layers - and this could have been prevented by including a few more layers, such as using an open source library to rewrite the image, reviewing the image source before pulling it in, or again not giving it executable access by using the PHP include() function.

But what’s terrifying is how simple it is to hijack a site, how easy it is to get access to your system and private data, and how easy it is to overlook security vulnerabilities - especially with open source tooling and those that take plugins.

As Ben explains, sometimes the core code itself is really secure, but then you get two different plugins that when used together accidentally create a security vulnerability. That by itself is one of the most challenging as you can audit each plugin individually, and still not know you’re opening up your system to malicious actors.

This is why it's not just important to stay up to date on the latest security measures and best practices, but to be constantly thinking like a hacker and testing your code for vulnerabilities.

Learn More

You can watch thefull video to learn more how viruses operate, how to quickly build your own PHP virus (but you must promise to use it for good), and what to watch for in order to protect yourself, your customers, and your architecture.

Laravel introduces eloquent relationships from laravel 5.0 onwards. We all know, while we creating an application we all have foreign keys. Each table will be connected to some other. Eloquent make easy to connect each tables easily. Here we will One to one, one to many and many to many relationships. Here we will see three types of relationships,
   
. One to one relationships
    . One to many relationships
    . Many to many relationships

Why Eloquent Relationships

Here we have 2 tables, students and marks, so for join each table,

$student = student::join(‘marks’,’marks.student_id,’=’,students.id’)->where(‘students.id’,’1’)->get();

dd($student);

the above query is to long, so when we connect more tables its too tough we will be having a big query and complicated.

Model Query using Relationships

$student_marks = student::find(1);

dd($student_marks->mark1);

The above example is a simple example of eloquent relationships. We can reduce the first query into a simple one.

ONE TO ONE RELATIOSHIPS

Here we are creating 2 tables:
* Users
* Phones

Now we can see one to one relationships using hasone() and belongsto().

We need to create table using migrations

Create migrations

users table will be created by using

Schema::create('users', function (Blueprint $table) {

 $table->increments('id');

 $table->string('name');

 $table->string('email')->unique();

 $table->string('password');

 $table->rememberToken();

 $table->timestamps();

});

Phones table will be created by

Schema::create('phones', function (Blueprint $table) {

 $table->increments('id');

 $table->integer('user_id')->unsigned();

 $table->string('phone');

 $table->timestamps();

 $table->foreign('user_id')->references('id')->on('users')

 ->onDelete('cascade');

});

After that we need to create model for each tables, as we all know if the table name is laravel table name will be ending with ‘s’ and model name will be without ‘s’ of the same table name.

User model

<?php

namespace App;

use Illuminate\Notifications\Notifiable;

use Illuminate\Foundation\Auth\User as Authenticatable;



class User extends Authenticatable

{

 use Notifiable;



 

 protected $fillable = [

 'name', 'email', 'password',

 ];



 

 protected $hidden = [

 'password', 'remember_token',

 ];



 

 public function phone()

 {

 return $this->hasOne('App\Phone');

 }

}

Phone Model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;



class Phone extends Model

{

 

 public function user()

 {

 return $this->belongsTo('App\User');

 }

}

For Creating records

$user = User::find(1);

$phone = new Phone;

$phone->phone = '9080054945';

$user->phone()->save($phone);



$phone = Phone::find(1);

$user = User::find(10);

$phone->user()->associate($user)->save();

Now we can get our records by

$phone = User::find(1)->phone;

dd($phone);



$user = Phone::find(1)->user;

dd($user);

ONE TO MANY RELATIONSHIPS

Here we will use hasMany() and belongsTo() for relationships

Now we are creating two tables, posts and comments, we will be having a foreign key towards posts table.


Migrations for posts and comments table

Schema::create('posts', function (Blueprint $table) {

 $table->increments('id');

 $table->string("name");

 $table->timestamps();

});



Schema::create('comments', function (Blueprint $table) {

 $table->increments('id');

 $table->integer('post_id')->unsigned();

 $table->string("comment");

 $table->timestamps();

 $table->foreign('post_id')->references('id')->on('posts')

 ->onDelete('cascade');

});

Now we will create Post Model and Comment Model

Post Model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;



class Post extends Model

{

 

 public function comments()

 {

 return $this->hasMany(Comment::class);

 }

}

Comment Model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;



class Comment extends Model

{

 

 public function post()

 {

 return $this->belongsTo(Post::class);

 }

}

Now we can create records

$post = Post::find(1);

$comment = new Comment;

$comment->comment = "Hi Harikrishnan";

$post = $post->comments()->save($comment);

$post = Post::find(1);



$comment1 = new Comment;

$comment1->comment = "How are You?";

$comment2 = new Comment;

$comment2->comment = "Where are you?";

$post = $post->comments()->saveMany([$comment1, $comment2]);



$comment = Comment::find(1);

$post = Post::find(2);

$comment->post()->associate($post)->save();

Now we can get records

$post = Post::find(1);

$comments = $post->comments;

dd($comments);



$comment = Comment::find(1);

$post = $comment->post;

dd($post);

MANY TO MANY RELATIONSHIPS

Many to many is little bit different and complicated than the above two.



In this example, I will create users, roles, and role, users_tables, here each table will be connected each other using the foreign keys.



Using belongsToMany() we will use see a demo of Many to many relationship

Create Migrations

Schema::create('users', function (Blueprint $table) {

 $table->increments('id');

 $table->string('name');

 $table->string('email')->unique();

 $table->string('password');

 $table->rememberToken();

 $table->timestamps();

});



Schema::create('roles', function (Blueprint $table) {

 $table->increments('id');

 $table->string('name');

 $table->timestamps();

});



Schema::create('role_user', function (Blueprint $table) {

 $table->integer('user_id')->unsigned();

 $table->integer('role_id')->unsigned();

 $table->foreign('user_id')->references('id')->on('users')

 ->onDelete('cascade');

 $table->foreign('role_id')->references('id')->on('roles')

 ->onDelete('cascade');

});

Create Models

User Model

<?php

namespace App;

use Illuminate\Notifications\Notifiable;

use Illuminate\Foundation\Auth\User as Authenticatable;



class User extends Authenticatable

{

 use Notifiable;



 

 protected $fillable = [

 'name', 'email', 'password',

 ];



 

 protected $hidden = [

 'password', 'remember_token',

 ];



 

 public function roles()

 {

 return $this->belongsToMany(Role::class, 'role_user');

 }

}

Role Model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;



class Role extends Model

{

 

 public function users()

 {

 return $this->belongsToMany(User::class, 'role_user');

 }

}

UserRole Model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;



class UserRole extends Model

{

}

Now we can create records

$user = User::find(2); 

$roleIds = [1, 2];

$user->roles()->attach($roleIds);



$user = User::find(3); 

$roleIds = [1, 2];

$user->roles()->sync($roleIds);



$role = Role::find(1); 

$userIds = [10, 11];

$role->users()->attach($userIds);



$role = Role::find(2); 

$userIds = [10, 11];

$role->users()->sync($userIds);

Now we can retrieve records

$user = User::find(1); 

dd($user->roles);



$role = Role::find(1);

dd($role->users);

Hence laravel Eloquent is more powerful and we do relationships easily compared to native query. We will be having three more relationships in laravel. Ie.., has many, one to many polymorphic and many to many polymorphic. With eloquent relationship we can easily connect the tables each other. One to one relationships we can connect two tables with their basic functionalities. In one to many we will connect with single table with multiple options. In Many to many we will be having more tables.

The following is a sponsored blogpost by Cloudways

Developing an application is not the sole thing you should bank on. You must strive to find the best hosting solution to deploy that application also. The application’s speed is dependent on the hosting provider, that is why I always advise you to go for the best hosting solution to get the ultimate app performance.

Now a days, it is a big challenge to choose any web hosting, as each hosting has its own pros and cons which you must know, before considering it finally for the deployment. I don’t recommend shared hosting for PHP/Laravel based applications, because you always get lot of server hassles like downtime, hacking, 500 errors, lousy support and other problems that are part and parcel of shared hosting.

For PHP applications, you must focus on more technical aspects like caching, configs, databases, etc. because these are essential performance points for any vanilla or framework-based PHP application. Additionally, if the app focuses on user engagement (for instance, ecommerce store), the hosting solution should be robust enough to handle spikes in traffic.

Here, I would like to introduce Cloudways PHP server hosting to you which provides easy, developer and designer friendly managed hosting platform. With Cloudways, you don't need to focus on PHP hosting, but must focus on building your application. You can easily launch cloud servers on five providers including DigitalOcean, Linode, Vultr, AWS and GCE.

Cloudways ThunderStack

Being a developer, you must be familiar with the concept of stack - an arrangement of technologies that form the underlying hosting solution.

To provide a blazing fast speed and a glitch-free performance, Cloudways has built a PHP stack, known as ThunderStack. This stack consists of technologies that offer maximum uptime and page load speed to all PHP applications. Check out the following visual representation of ThunderStack and the constituent technologies:





As you can see, ThunderStack comprises of a mix of static and dynamic caches with two web servers, Nginx and Apache. This combination ensures the ultimate experience for the users and visitors of your application.

Frameworks and CMS

The strength and popularity of PHP lies in the variety of frameworks and CMS it offers to the developers. Realizing this diversity, Cloudways offers a hassle-free installation of major PHP frameworks including Symfony, Laravel, CakePHP, Zend, and Codeigniter. Similarly, popular CMS such as WordPress, Bolt, Craft, October, Couch, and Coaster CMS - you can install these with the 1-click option. The best part is that if you have a framework or CMS that is not on the list, you can easily install it through Composer.

1-Click PHP Server & Application Installation

Setting up a stack on an unmanaged VPS could take an entire day!

When you opt for Cloudways managed cloud hosting, the entire process of setting up the server, installation of core PHP files and then the setup of the required framework is over in a matter of minutes.

Just sign up at Cloudways, choose your desired cloud provider, and select the PHP stack application.





As you can see, your LAMP stack is ready for business in minutes.

Many PHP applications fail because essential services are either turned off or not set up properly. Cloudways offers a centralized location where you can view and set the status of all essential services such as:



* Apache
* Elasticsearch
* Memcached
* MySQL
* PHP-FPM
* Nginx
* New Relic
* Redis
* Varnish





Similarly, you can manage SMTP add-ons without any fuss.

Staging Environment

With Cloudways, you can test your web applications for possible bugs and errors before taking it live.

Using the staging feature, developers can first deploy their web sites on test domains where they can analyze the applications performance and potential problems. This helps site administrators to fix those issues timely and view the application performance in real-time.

A default sub domain comes pre-installed with the newly launched application, making it easy for the administrators to test the applications on those testing subdomains. Overall, it's a great feature which helps developers know about the possible errors that may arise during the live deployment.

Pre-Installed Composer & Git

PHP development requires working with external libraries and packages. Suppose you are working with Laravel and you need to install an external package. Since Composer has become the standard way of installing packages, it comes preinstalled on the Cloudways platform. Just launch the application and start using Composer in your project.

Similarly, if you are familiar with Git and maintain your project on GitHub or BitBucket, you don’t need to worry about Git installation. Git also comes pre-configured on Cloudways. You can start running commands right after application launch.

Cloudways MySQL Manager

When you work with databases in PHP, you need a database manager. On the Cloudways platform, you will get a custom-built MySQL manager, in which you can perform all the tasks of a typical DB manager.




However, if you wish to install and use another database manager like PHPMyAdmin, you can install it by following this simple guide on installing PHPMyadmin.

Server & Application Level SSH

If you use Linux, you typically use SSH for accessing the server(s) and individual applications. A third-party developer requires application and server level access as per the requirements of the client. Cloudways offers SSH access to fit the requirements of the client and users.

PHP-FPM, Varnish & Cron Settings

Cloudways provides custom UI panel to set and maintain PHP-FPM and Varnish settings. Although the default configuration is already in place, you can easily change all the settings to suit your own, particular development related requirements. In Varnish settings, you can define URL that you want to exclude from caching. You can also set permissions in this panel.




Cron job is a very commonly used component of PHP application development process. On Cloudways platform, you can easily set up Cron jobs in just a few clicks. Just declare the PHP script URL and the time when the script will run.

Cloudways API & Personal Assistant Bot

Cloudways provides an internal API that offers all important aspects of the server and application management. Through Cloudways API, you can easily develop, integrate, automate, and manage your servers and web apps on Cloudways Platform using the RESTful API. Check out some of the use cases developed using Cloudways API. You just need your API key and email for authentication of the HTTP calls on API Playground and custom applications.




Cloudways employs a smart assistant named CloudwaysBot to notify all users about server and application level issues. CloudwaysBot sends the notifications on pre-approved channels including email, Slack and popular task management tools such as Asana and Trello.

Run Your APIs on PHP Stack

Do you have your own API which you want to run on the PHP stack? No problem, because you can do that, too with Cloudways! You can also use REST API like Slim, Silex, Lumen, and others. You can use APIs to speed up performance and require fast servers with lots of resources. So, if you think that your API response time is getting slower due to the large number of requests, you can easily scale your server(s) with a click to address the situation.

Team Collaboration

When you work on a large number of applications with multiple developers, you need to assign them on any specific application. Cloudways provides an awesome feature of team collaboration through which you can assign developers to specific application and give access to them. You can use this tool to assign one developer to multiple applications. Through team feature, you can connect the team together and work on single platform. Access can be of different type; i.e. billing, support and console. You can either give the full access or a limited one by selecting the features in Team tab.

Final Words

Managed cloud hosting ensures that you are not bothered by any hosting or server related issues. For practical purposes, this means that developers can concentrate on writing awesome code without worrying about underlying infrastructure and hosting related issues. Do sign up and check out Cloudways for the best and the most cost-effective cloud hosting solution for your next PHP project!

Models and controllers are one of the most essential programming handlers in the Laravel MVC framework, and both are used vastly for different functional operations. Models in Laravel are created inside the app folder and are mostly used to interact with the database using Eloquent ORM, while the controllers are located inside the directory App/Http/Controllers.

As a programmer, you should have the knowledge how to keep the balance in between the programming usage of Models and controllers. As which one should be more utilized for allowing functional tasks in applications deployed on any PHP MySQL hosting.

What is the Concept of Thin Controller and FAT Models

The concept of the thin controller and fat model is that we do less work in our controllers and more work in our models. Like we use our controllers to validate our data and then pass it to the models. While in models, we define our actual functional logic and main coding operations of the desired application. This code structuring process is also a very basic concept of MVC and also the differentiating factor from the conventional complex programming which we mistakenly ignore sometimes.

Why FAT Controllers Are Bad For Handling Code

Controllers are always meant to be defined short and concise, and it should only be used for receiving requests and return responses to it. Anything else further should be programmed in Models, which is actually made for main functional operations.

Placing functional logic in controllers can be bad for many reasons for your applications deployed on anyhosting for PHP. As it not only makes code structure long but also makes it complex sometimes. Further placing code in Controllers is also not recommended because if same functionality is needed somewhere else in route, then pulling out the whole code from their becomes difficult and so its reusability in the application.

Though Laravel is an MVC framework while developing on laravel, we sometimes ignore this and write mostly all our code including the extending of App\Model and all our functional logic in controller route methods. What we can do here is we can create a sub model of our parent model. For example, our parent model is User then we can create another sub model of username in CustomerModel if you are using the same User model for all types of users. In this model, we will write all the logic related to user type Customer.

So now let's take an example of my existing blog creating comment system with laravel and vuejs. In that article, you can see I have made so much mess in my controller methods. Mostly, I have written all my comments logic in my methods, so to shorten that let's clean them in this article. Inside app folder, I will create a new file with name CommentModel.php. Inside this file, I will write my whole logic for comment functions. This is my basic file:

<?php
namespace App;

use App\Comment;
use App\CommentVote;
use App\CommentSpam;
use App\User;
use Auth;

class CommentModel
{


}

?>

Right now it contains no function but has the reference of all my models which I required for this model. Let's first add a function namedgetallcomments passing$pageId as a parameter inside it. The function will get all the comments for the given page:

public function getAllComments($pageId)
 {
 $comments = Comment::where('page_id',$pageId)->get();

 $commentsData = [];


 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $replies = $this->replies($key->id);
 $photo = $user->first()->photo_url;
 $reply = 0;
 $vote = 0;
 $voteStatus = 0;
 $spam = 0;
 if(Auth::user()){
 $voteByUser = CommentVote::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();


 if($voteByUser){
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if($spamComment){
 $spam = 1;
 }
 }


 if(sizeof($replies) > 0){
 $reply = 1;
 }

 if(!$spam){
 array_push($commentsData,[
 "name" => $name,
 "photo_url" => (string)$photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "reply" => $reply,
 "votedByUser" =>$vote,
 "vote" =>$voteStatus,
 "spam" => $spam,
 "replies" => $replies,
 "date" => $key->created_at->toDateTimeString()
 ]);
 } 


 }
 $collection = collect($commentsData);
 return $collection->sortBy('votes');
 }

Now I will create another function namedreplies which takes$commentId as a parameter. The function is more or less programmed in the same manner as the upper function get all comments.

protected function replies($commentId)
 {
 $comments = Comment::where('reply_id',$commentId)->get();
 $replies = [];



 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $photo = $user->first()->photo_url;

 $vote = 0;
 $voteStatus = 0;
 $spam = 0; 


 if(Auth::user()){
 $voteByUser = CommentVote::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();

 if($voteByUser){
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if($spamComment){
 $spam = 1;
 }
 }
 if(!$spam){


 array_push($replies,[
 "name" => $name,
 "photo_url" => $photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "votedByUser" => $vote,
 "vote" => $voteStatus,
 "spam" => $spam,
 "date" => $key->created_at->toDateTimeString()
 ]);
 }




 }


 $collection = collect($replies);
 return $collection->sortBy('votes');
 }

Now lets create a functioncreate comment which passes$array as a parameter in it:

public function createComment($arary)
 {
 $comment = Comment::create($array);


 if($comment)
 return [ "status" => "true","commentId" => $comment->id ];
 else
 return [ "status" => "false" ]; 
 }

Similarly, Now I will create all the function for comment in myCommentModel, so that all the functions gets accumulated in one model.

<?php
namespace App;

use App\Comment;
use App\CommentSpam;
use App\CommentVote;
use App\User;
use Auth;

class CommentModel
{
 public function getAllComments($pageId)
 {
 $comments = Comment::where('page_id', $pageId)->get();

 $commentsData = [];

 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $replies = $this->replies($key->id);
 $photo = $user->first()->photo_url;
 $reply = 0;
 $vote = 0;
 $voteStatus = 0;
 $spam = 0;
 if (Auth::user()) {
 $voteByUser = CommentVote::where('comment_id', $key->id)->where('user_id', Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id', $key->id)->where('user_id', Auth::user()->id)->first();

 if ($voteByUser) {
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if ($spamComment) {
 $spam = 1;
 }
 }

 if (sizeof($replies) > 0) {
 $reply = 1;
 }

 if (!$spam) {
 array_push($commentsData, [
 "name" => $name,
 "photo_url" => (string) $photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "reply" => $reply,
 "votedByUser" => $vote,
 "vote" => $voteStatus,
 "spam" => $spam,
 "replies" => $replies,
 "date" => $key->created_at->toDateTimeString(),
 ]);
 }

 }
 $collection = collect($commentsData);
 return $collection->sortBy('votes');
 }

 protected function replies($commentId)
 {
 $comments = Comment::where('reply_id', $commentId)->get();
 $replies = [];

 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $photo = $user->first()->photo_url;

 $vote = 0;
 $voteStatus = 0;
 $spam = 0;

 if (Auth::user()) {
 $voteByUser = CommentVote::where('comment_id', $key->id)->where('user_id', Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id', $key->id)->where('user_id', Auth::user()->id)->first();

 if ($voteByUser) {
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if ($spamComment) {
 $spam = 1;
 }
 }
 if (!$spam) {

 array_push($replies, [
 "name" => $name,
 "photo_url" => $photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "votedByUser" => $vote,
 "vote" => $voteStatus,
 "spam" => $spam,
 "date" => $key->created_at->toDateTimeString(),
 ]);
 }

 }

 $collection = collect($replies);
 return $collection->sortBy('votes');
 }

 public function createComment($arary)
 {
 $comment = Comment::create($array);

 if ($comment) {
 return ["status" => "true", "commentId" => $comment->id];
 } else {
 return ["status" => "false"];
 }

 }

 public function voteComment($commentId, $array)
 {
 $comments = Comment::find($commentId);
 $data = [
 "comment_id" => $commentId,
 'vote' => $array->vote,
 'user_id' => $array->users_id,
 ];

 if ($array->vote == "up") {
 $comment = $comments->first();
 $vote = $comment->votes;
 $vote++;
 $comments->votes = $vote;
 $comments->save();
 }

 if ($array->vote == "down") {
 $comment = $comments->first();
 $vote = $comment->votes;
 $vote--;
 $comments->votes = $vote;
 $comments->save();
 }

 if (CommentVote::create($data)) {
 return true;
 }

 }

 public function spamComment($commentId, $array)
 {
 $comments = Comment::find($commentId);

 $comment = $comments->first();
 $spam = $comment->spam;
 $spam++;
 $comments->spam = $spam;
 $comments->save();

 $data = [
 "comment_id" => $commentId,
 'user_id' => $array->users_id,
 ];

 if (CommentSpam::create($data)) {
 return true;
 }

 }
}
?>

Now we have all our required methods inCommentModel. So now let's clean upCommentController which is currently bit complex and lengthy in code structure. As right nowCommentController look like this:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Http\Requests;
use App\Comment;
use App\CommentVote;
use App\CommentSpam;
use App\User;
use Auth;

class CommentController extends Controller
{


 
 public function index($pageId)
 {
 $comments = Comment::where('page_id',$pageId)->get();

 $commentsData = [];




 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $replies = $this->replies($key->id);
 $photo = $user->first()->photo_url;
 $reply = 0;
 $vote = 0;
 $voteStatus = 0;
 $spam = 0;
 if(Auth::user()){
 $voteByUser = CommentVote::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();


 if($voteByUser){
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if($spamComment){
 $spam = 1;
 }
 }


 if(sizeof($replies) > 0){
 $reply = 1;
 }

 if(!$spam){
 array_push($commentsData,[
 "name" => $name,
 "photo_url" => (string)$photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "reply" => $reply,
 "votedByUser" =>$vote,
 "vote" =>$voteStatus,
 "spam" => $spam,
 "replies" => $replies,
 "date" => $key->created_at->toDateTimeString()
 ]);
 } 


 }
 $collection = collect($commentsData);
 return $collection->sortBy('votes');
 }

 protected function replies($commentId)
 {
 $comments = Comment::where('reply_id',$commentId)->get();
 $replies = [];



 foreach ($comments as $key) {
 $user = User::find($key->users_id);
 $name = $user->name;
 $photo = $user->first()->photo_url;

 $vote = 0;
 $voteStatus = 0;
 $spam = 0; 


 if(Auth::user()){
 $voteByUser = CommentVote::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();
 $spamComment = CommentSpam::where('comment_id',$key->id)->where('user_id',Auth::user()->id)->first();

 if($voteByUser){
 $vote = 1;
 $voteStatus = $voteByUser->vote;
 }

 if($spamComment){
 $spam = 1;
 }
 }
 if(!$spam){


 array_push($replies,[
 "name" => $name,
 "photo_url" => $photo,
 "commentid" => $key->id,
 "comment" => $key->comment,
 "votes" => $key->votes,
 "votedByUser" => $vote,
 "vote" => $voteStatus,
 "spam" => $spam,
 "date" => $key->created_at->toDateTimeString()
 ]);
 }




 }


 $collection = collect($replies);
 return $collection->sortBy('votes');
 }

 
 public function store(Request $request)
 {
 $this->validate($request, [
 'comment' => 'required',
 'reply_id' => 'filled',
 'page_id' => 'filled',
 'users_id' => 'required',
 ]);
 $comment = Comment::create($request->all());
 if($comment)
 return [ "status" => "true","commentId" => $comment->id ];
 }

 
 public function update(Request $request, $commentId,$type)
 {
 if($type == "vote"){


 $this->validate($request, [
 'vote' => 'required',
 'users_id' => 'required',
 ]);

 $comments = Comment::find($commentId);
 $data = [
 "comment_id" => $commentId,
 'vote' => $request->vote,
 'user_id' => $request->users_id,
 ];

 if($request->vote == "up"){
 $comment = $comments->first();
 $vote = $comment->votes;
 $vote++;
 $comments->votes = $vote;
 $comments->save();
 }

 if($request->vote == "down"){
 $comment = $comments->first();
 $vote = $comment->votes;
 $vote--;
 $comments->votes = $vote;
 $comments->save();
 }

 if(CommentVote::create($data))
 return "true";
 }

 if($type == "spam"){


 $this->validate($request, [
 'users_id' => 'required',
 ]);

 $comments = Comment::find($commentId);


 $comment = $comments->first();
 $spam = $comment->spam;
 $spam++;
 $comments->spam = $spam;
 $comments->save();

 $data = [
 "comment_id" => $commentId,
 'user_id' => $request->users_id,
 ];

 if(CommentSpam::create($data))
 return "true";
 }
 }

 
 public function destroy($id)
 {
 }
}?>

After cleaning up the controller it will look much simpler and easy to understand like this:

<?php

namespace App\Http\Controllers;

use App\CommentModel;
use Illuminate\Http\Request;

class CommentController extends Controller
{

 private $commentModel = null;
 private function __construct()
 {
 $this->commentModel = new CommentModel();
 }

 
 public function index($pageId)
 {
 return $this->commentModel->getAllComments($pageId);
 }

 
 public function store(Request $request)
 {
 $this->validate($request, [
 'comment' => 'required',
 'reply_id' => 'filled',
 'page_id' => 'filled',
 'users_id' => 'required',
 ]);
 return $this->commentModel->createComment($request->all());
 }

 
 public function update(Request $request, $commentId, $type)
 {
 if ($type == "vote") {

 $this->validate($request, [
 'vote' => 'required',
 'users_id' => 'required',
 ]);

 return $this->commentModel->voteComment($commentId, $request->all());
 }

 if ($type == "spam") {

 $this->validate($request, [
 'users_id' => 'required',
 ]);

 return $this->commentModel->spamComment($commentId, $request->all());
 }
 }

}
?>

Wrap Up!

So Isn't it looking much cleaner and simpler to understand now? This is what actually a thin controller and fat model looks like. We have all our logic related to Comment system programmed in ourCommentModel and our controller is now just used to transfer data from the user to our model and returning the response which is coming from our model.

So this is how the structuring of the thin controller and fat model is made. Give your thoughts in the comments below.

It took me quite some time to settle on my first blog post in this series and I found myself thinking about the most requested functionality in my career – The good ‘ol Custom CMS – typically geared towards clients that want a straight forward, secure solution that can be expanded upon in a modular format and that’s their IP.

This will be our starting point. A blank slate to build something epic with clean code and even cleaner design. And in the spirit of building from scratch, I will refrain from using classes or a framework. The main reasoning behind this is to truly get everyone acquainted with and excited about PHP development.

Join me as I transform rudimentary code into something extraordinary that can be morphed into just about any Content, PHP, and MySQL driven project. So without further ado, let’s jump into it!

The bare necessities

If you’re just getting started with development, there’s a nifty bite sized server called UniformServer that will be your best friend throughout your coding career. PHPMyAdmin (an awesome visual db management tool) comes built in so if you’re looking for a work right out of the box solution, this is it.

Alternatively, you can opt for XAMPP or use an alternative server of your choice.

Now here’s where the exciting stuff begins, mapping things out.

I don’t see this done/encouraged often enough. Feel free to grab a piece of paper to logically map out your steps or produce a rough draft of where you’d like this project to go.

In this tutorial, I would like to achieve the following:

DB, DB, Set up your DB.

This requires a bit of planning but let’s start of with the basic structure we need to see this through.

We are going to need a user table and a content table and are a few ways to tackle this.

If you’re using the PHPMyAdmin tool you can create your database, add user permissions (Click on Permissions after creating your database), and create a table with ease.



If you’re like me and prefer to look at good ‘ol SQL then writing an SQL statement is the preferred approach.

CREATE TABLE <code>mydbname</code>.<code>content</code> ( <code>ID</code> INT(11) NOT NULL AUTO_INCREMENT , <code>title</code> VARCHAR(100) NOT NULL , <code>content</code> LONGTEXT NOT NULL , <code>author</code> VARCHAR(50) NOT NULL , PRIMARY KEY (<code>ID</code>)) ENGINE = MyISAM COMMENT = 'content table';

Understanding the SQL statement

In a nutshell we are creating a table with important fields. Namely:

####

ID | Title | Content | Author

#######

The ID field is our unique identifier.Now we can move on to the file structure.

Everything has a place in the file structure game

You can use a structure that speaks to your coding style / memory.

I tend to use the following:



Choose a name for your CMS, which should be placed at the webroot of your localhost/server.

Replicate the folder structure as per the above example.

Next, we’re going to create a basic connection file.

You can create a conn.php file in your root/includes folder.

The connection file will provide crucial information to connect to the database.

Type the following into your conn.php file, remember to include your own database credentials.

<?php

$letsconnect = new mysqli("localhost","dbuser","dbpass","dbname");

?>

Let’s go to the homepage (index.php)

Create a file called index.php at the root of your CMS folder.

I will be adding comments in my code to help you understand what each line does.

Comments are a useful tool for developers to add important notes private to their code.

We need to pull information from the database so it’s imperative that we include our connection file.

<?php

include('includes/conn.php');

if ($letsconnect -> connect_errno) { echo "Error " . $letsconnect -> connect_error;

}else{

$getmydata=$letsconnect -> query("SELECT * FROM content");

foreach($getmydata as $mydata){	echo "Title: ";	echo $mydata['title'];	echo "<br/>";	echo "Content: ";	echo $mydata['content'];	echo "<br/>";	echo "Author: ";	echo $mydata['author'];	echo "<br/>";	echo "<br/>";

}

}

$letsconnect -> close();

?>

Let’s get a (very) basic backend up and running

Create a file called index.php in your backend folder.

We need to create a basic form to capture our data.

Let’s code some HTML!

<html>

<head><title>Backend - Capture Content</title></head>

<body>

<form action="<?php $_SERVER[‘PHP_SELF’];?>" method="post">

<input type="text" name="title" placeholder="Content Title here" required/>

<textarea name="content">Content Here</textarea>

<input type="text" name="author" placeholder="Author" required/>

<input type="submit" value="Save My Data" name="savedata"/>

</form>

</body>

</html>

Next, we need to process the form data.

Type the following just above the

<form> 

tag.

<?php

if(isset($_POST['savedata'])){

include('../includes/conn.php');

if ($letsconnect->connect_error) {

die("Your Connection failed: " . $letsconnect->connect_error);

}else{

$sql = "INSERT INTO content(title,content,author)VALUES ('".$_POST["title"]."', '".$_POST["content"]."', '".$_POST["author"]."')";

if (mysqli_query($letsconnect, $sql)) {

echo "Your data was saved successfully!";

} else { echo "Error: " . $sql . "" . mysqli_error($letsconnect);

} $letsconnect->close();

}

}

?>

Note, this is a basic MySQL query to insert data. However, before using this in production it's important to add proper escaping and security to prevent SQL injections. This will be covered in the next article.

Congrats you made it to the end of tutorial 1!

Test out your creation, modify your content, and play around.

Go to your sitename/index.php to see your frontend after capturing data via sitename/backend/index.php

Next Up:

codewithme Now With Security, Functionality, and Aesthetics in mind.

Conclusion

Coding doesn’t have to be daunting and it’s my aim to divide a complex system into bitesized tutorials so you can truly use the knowledge you’ve acquired in your own projects.