‫All right guys.
‫So now we want to handle the submission of the create job listing form.
‫And there's going to be a few videos to this.
‫And this one we're going to get the data.
‫We're going to add a little bit of of security on top of the the PDO prepared statements.
‫We're going to do some sanitation.
‫And then in the next video we'll handle implementing the validation class that we use, that we created
‫the string method to make sure that required fields actually have something filled in.
‫And then we'll do the video where we actually insert the data.
‫So it's going to be broken up into a few parts.
‫Now let's start with the submission.
‫So if we go to the view here this is the create view right.
‫So if we go to app not controllers views create view.
‫And we look at the form tag, it's making a Post request which is what we want.
‫But we need to direct it to a specific route.
‫And where I want that to go, let's say action, where I want it to go is going to be slash listings.
‫Okay.
‫So that means we have to create a route for a Post request to slash listings.
‫Now if we look in our routes dot PHP, we already have a route that goes to slash listings.
‫However it's a Get request.
‫And remember the first version of our router?
‫We just had a URL that mapped to a file that mapped to a controller, so we wouldn't have been able
‫to do what we're about to do, which is add a post post route.
‫Right.
‫So we could actually just copy this right here.
‫And then down at the bottom we're going to change that, get to a post.
‫And I can have the same URL in two different routes as long as that method is different.
‫So now when we submit the form we want it to call in our listing controller.
‫We want it to call a method called store.
‫And that's going to handle storing the data, the data in the database.
‫So let's save that and then let's go to our controller our listing controller.
‫And we're going to go down to the bottom here.
‫And I'll create a comment and let's say store data.
‫In database.
‫And let's see.
‫So for return we're just going to have void.
‫And then let's say public function store.
‫And then what I'm going to do is inspect and die, and I'm going to pass in the post superglobal because
‫remember, that's how we get the data from the form because it's a post form.
‫Let's see what is going on here.
‫Oh, I didn't put this inside the class, so I want to go in here, make sure it's in the class.
‫Okay, so now I'm going to just refresh this create page and I'll just say test listing.
‫This is a test.
‫And we'll throw in salary.
‫Company name.
‫The city.
‫All right.
‫So I'll just submit this and then this is what I get.
‫Right.
‫So this is the post Superglobal which has all the data submitted.
‫And each one of these field keys, each one of these keys are the names in the form, the name attribute.
‫So I want to add just a little extra layer of security and only allow these fields to be submitted through
‫post.
‫I don't want someone to be able to submit a post variable of server or something like that.
‫It has to be one of these.
‫So what we can do is create an array.
‫Let's go in store right above that, inspect and die and let's create allowed fields.
‫So anything I put in here, I want that those to be the only fields that can be in the post superglobal.
‫Or I should say that can do anything from that post.
‫Superglobal.
‫Now I'm just going to paste these in, copy and paste these in because I don't want to sit here and
‫type all these.
‫So we have just, you know, title, description, salary, basically all this stuff here.
‫Um, now, what I've done is just put it into an array.
‫I haven't done anything with it.
‫So there's a few ways we can implement this one.
‫We could loop through the post superglobal through that array, and then we could basically check to
‫see if each one is in this allowed fields.
‫Or we can use a combination of two PHP functions array intersect key and array flip.
‫So let me show you what I mean.
‫I'm going to say new listing data.
‫This is ultimately this is the data that's going to come in from the form after it's sanitized and validated
‫and all that.
‫So let's set that to array underscore intersect underscore key.
‫Now what this does is it takes in two arrays and it returns a new array.
‫As long as the key is in both arrays okay.
‫And when I say key I mean this title description salary.
‫So the first array I want to pass in is the post.
‫Right.
‫The whole just all the data that's submitted.
‫The second array is going to be allowed fields.
‫Now there's a problem with this because in allowed fields these aren't the keys.
‫These are the values.
‫Since there's no since it's not an associative array with, you know, keys that we created, they're
‫numeric keys like zero, one, two, etcetera.
‫But what we can do is wrap allowed fields in a function called array flip.
‫And what that does let me just there we go.
‫So we wrap that.
‫And what that does is it reverses.
‫It turns the keys into the values and the values into the keys.
‫So now these values will be keys and they'll match the post keys.
‫Okay.
‫So let's go down to our inspect and let's say new listing data.
‫And if I refresh it'll submit this data again and we see the same thing.
‫Now what's what's good about this.
‫And the reason we did this is because if the if it's not in allowed fields, then it's not going to
‫be in this new listing data.
‫So to show you that if I get rid of the title out of out of allowed fields and I refresh this and submit
‫title is now gone because it doesn't match this array.
‫All right.
‫So we know that that's working.
‫I'm going to put title back though.
‫And now it's back.
‫So that's kind of the first layer of security that I want to do when we submit this.
‫Now the user ID if you remember we have a user underscore ID field in the listing table.
‫And that's going to be the user that owns the listing.
‫However we don't have authentication or sessions or anything like that just yet, so I'm just going
‫to hard code it for now by just saying new listing data.
‫And I'm going to manually set user underscore ID to just one.
‫And later on we'll set this to the session variable for the user that's logged in that's actually submitting
‫the data okay.
‫That's the second thing I want to do.
‫Then I want to sanitize the data by not letting special characters like HTML tags, etcetera.
‫And just to show you if I were to go back.
‫Here and put in like H one.
‫So if I do that.
‫And then whatever.
‫It doesn't matter.
‫Anything else.
‫If I submit that you can see even on the page here, it's parsing the HTML.
‫So what I want to do is have a sanitize function that we can run on all of the values in the new listing
‫data array.
‫So that function, the sanitize function.
‫I'm going to put that in the helpers file.
‫And we can use it anywhere we want.
‫And the sanitize function is going to use the filter var function which we briefly looked at.
‫So let's say sanitize data.
‫And it's going to take in a.
‫Pram, which is going to be a string, and we're going to call that dirty.
‫So it's the dirty data that needs to be sanitized and then return string.
‫Okay, then we'll add function, not public function.
‫Remember, we're not in a class.
‫We're just in a file full of functions.
‫And we're going to call this sanitize.
‫It's going to take in that dirty variable.
‫And then we're going to return from this filter underscore var pass in dirty.
‫But I also want to trim it.
‫So I'm just going to wrap it in trim just to trim any whitespace.
‫And then we have to put in our filter because you can filter by emails ints.
‫Whatever the filter we want is called filter underscore sanitize underscore special chars because we
‫want to strip out any special characters now.
‫Yeah, that's all we want for this.
‫So let's save that.
‫And now we can use it.
‫We want to use it on every value in the array.
‫So there's a couple ways we can do that.
‫We could loop through the array and then run sanitize on each one.
‫Or we can use array map which does the same thing really just in one line.
‫So let's use that.
‫We'll say new listing data.
‫Set that to array underscore map.
‫We can pass in the function name that we want to run, which is sanitize, and then the array we want
‫to run it on, which is new listing data.
‫So it'll run that function on every item.
‫Now if I save this and this, this right here where it's parsing the HTML, if I reload with the sanitize.
‫Now that doesn't happen, right?
‫We just have this H one.
‫Hello.
‫In in here.
‫So that's just another layer of security we can add.
‫Now that we've done that, I want to do our validation because this doesn't do any validation.
‫Like I can still submit empty field, empty fields, you know, empty values.
‫And I'm not going to say that every all of these have to be filled.
‫Like if you don't want to put a phone number or salary benefits requirements, you don't need that stuff.
‫But I do want to make sure the title is there, the description, maybe the city and state in case there's
‫like a map feature or something like that.
‫So in the next video we're going to implement validation.