CrudForm

Generate the HTML for an insert form.

Here is a sample call:

$from_location = "keys.php";
$fields = array("key_key", "key_sha256", "secret", "created_at", "updated_at");
CrudForm::insertForm($fields, $from_location);

Insert data from a $_POST of one of our generated forms insert form into the database.

Here is a sample call:

$tablename = "tsugi_lti_key";
$fields = array("key_key", "key_sha256", "secret", "created_at", "updated_at");
CrudForm::handleInsert($tablename, $fields);

Generate the HTML for an update form.

Here is a sample call:

$from_location = "keys.php";
$fields = array("key_key", "key_sha256", "secret", "created_at", "updated_at");
$current = getCurrentFileUrl(__FILE__);
$retval = CrudForm::updateForm($row, $fields, $current, $from_location, true, true);

Apply the results of an update form to the database

Here is a sample call:

$tablename = "tsugi_lti_key";
$fields = array("key_id", "key_key", "secret", "created_at", "updated_at");
$where_clause .= "user_id = :UID";
$query_fields = array(":UID" => $_SESSION['id']);
$row =  CrudForm::handleUpdate($tablename, $fields, $where_clause, $query_fields, true, true);

This code very much depends on the $_POST data being generated from the form that this class created. For example it decides to delete or update based on a $_POST field from the button that was pushed. Also the primary key comes from the $_POST data, so this routine checks for consistency and provides a WHERE clause capability to make sure folks can only update data that belongs to them.

Also this code depends on database column naming conventions - in particular it knows that key_id is a primary key. In the above example, the ultimate WHERE clause will effectively be as follows:

UPDATE ... WHERE key_id = $_POST['key_id'] AND user_id = $_SESSION['id']

This way, even if the user forges the key_id data to be one that does not belong to them, the AND clause will stop the UPDATE from happening. If this is an administrator that can update any record - simply set the $where_clause to an empty string and $query_fields to an empty array.

If we were editing some context-wide data as instructor, we might add the current context_id of the logged in instructor to the WHERE clause.

Maps a field name to a presentable title.

Maps a default value to a field.

Produce the SELECT statement for a table, set of fields and where clause.