MVC - 清理数据，在哪里？
我正在使用 CakePHP，但这是一个关于 MVC 模式的问题。我的表单中有标签的输入文本（用逗号分隔）。为了添加标签，我创建了一个标签模型方法，该方法基本上检查标签是否存在，然后添加新标签或在标签计数器中添加新单位（标签模型具有以下字段：id、name、slug、count） 。 在控制器中，我分解标签字段并一次传递一个标签。 问题是：我在哪里清理数据？在控制器中还是在模型方法中？我认为它应该在控制器中，因为那是我爆炸的地方，但就可重用性而言，我认为我应该清理模型中的数据。 你怎么认为？
I'm using CakePHP but it's a question about the MVC pattern. I have in my form the input-text for the tags (separated by commas). To add the tags I've created a Tag model method that basically check if the tag exists and then add the new tag or just a new unit in the tag counter (the Tag model has these fields: id, name, slug, count).
In the controller I explode the tags field and pass one tag at a time.
The question is: where do I sanitize data? In the controller or in the model method? I think it should be in the controller because that's where I explode but in term of reusability I think I should sanitize data in the model.
What do you think?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我不同意清理控制器中存储的数据，并认为最好的地方是在模型中进行，因为控制器不应该知道数据是如何存储的，但清理需要这些知识（例如 mysql_real_escape_string() 用于存储 MySql 与用于 PostgresQL 的 pg_escape_string()，或者如果存储在 XML 文件中，则可能检查有效的 XML，或者用于不同存储机制的其他内容）。
为了防止跨站点脚本之类的事情，在存储之前不要清理数据，因为稍后您可能会对某些 html 标签进行合法使用，并且（理想情况下）在视图或控制器中执行此操作。
I disagree with sanitizing the data for storage in controller, and think the best place is to do it in model, as controller should not know how the data is stored, but sanitizing needs that knowledge (e.g.
mysql_real_escape_string()for storing a MySql vs.pg_escape_string()for PostgresQL, or maybe checking for valid XML if stored in an XML file, or something else for different storage mechanisms).To prevent things like cross site scripting, do not sanitize the data before storing, as you may have some legitimate use for some html tags later on, and do that (ideally) in view or in controller.
您应该清理客户端视图和服务器端控制器上的数据。
You should sanitize your data on the View for client-side and Controller for the server-side.
我想说的是，严格来说，清理数据应该在控制器中进行，但清理通常也指清理用户输入以避免许多问题，例如 SQL 注入。由于您在不同的上下文中使用“消毒”一词，因此我们必须更加注意该上下文是什么。
您没有清理用户输入，这意味着它实际上不需要在控制器中发生。您将根据您要保存的项目是否已存在于数据库中来更改此操作的结果。因此，在我看来，它应该发生在模型中（或者，正如 MunkiPhD 所指定的那样，在某种帮助程序类中拥有一个可以从任何地方调用的方法 - 但我说在模型中调用它）。
编辑：通常，在 MVC 中，模型知道是否应该将新行保存到数据库中或根据模型实例是否具有有效 ID 来更新现有行。如果它有 ID，则模型应保存到由该 ID 索引的行。如果没有，该模型将创建一个新模型。我的理解是，您想要做的就是知道在哪里让它决定是创建新的还是更新现有的，这发生在模型中。
I would say that, strictly speaking, sanitizing your data should occur in the controller, but sanitizing also generally refers to cleaning user input to avoid many issues, such as SQL injection. Since you're using the term "sanitize" in a different context, we have to pay more attention to what that context is.
You're not cleaning up user input, which means it doesn't really need to happen in the controller. You're changing the result of this action depending on whether or not the item you're saving already exists in the database. Therefore, in my mind, it should be happening in the model (or, as MunkiPhD specified, have a method in some sort of helper class that you can call from anywhere - but I say call it in the model).
Edit: Usually, in MVC, the model knows whether it's supposed to save a new row into the database or update an existing one based on whether or not your model instance has a valid ID. If it has an ID, the model should save to the row indexed by that ID. If it does not, the model creates a new one. It's my understanding that all you want to do is know where to make it decide whether to create a new one or update an existing one, and that happens in the model.
您希望从控制器中对其进行清理，但是，“来自”并不意味着“在”。有一个单独的类来清理数据 - 这样您就可以从任何需要的地方调用该类。
您基本上希望创建一个合同，让您的模型始终收到良好的数据，这意味着您必须事先对其进行清理。
You'd want to sanitize it in from your controller, however, "from" doesn't mean "in." Have a separate class sanitize the data - that way you can call that class from wherever you need to.
You basically want to create the contract that your model will receive good data all the time, which means you'd have to sanitize it beforehand.