An explanation of the 'Escape' function.

After using POG for the first time, you’ll notice that some parts of your information stored in the database have been converted to Base64 before being saved. Upon retrieval of the information, the object converts the data back into its original form. So, in effect this escaping and unescaping of information is transparent to the programmer, unless you look at the database directly.

For example, let’s assume I create an object to store user login information. My object attributes are as follows:

object name = User
attribute1 = username
type1 = varchar(255)
attribute2 = password
type2 = varchar(255)
attribute3 = age
type3 = int(4)

After my `user` object has been created by POG, I use it in my code as follows:

$user = new $User();
$user->username = “joel”;
$user->password = “password”;
$user->age = 24;
$user->Save();

The `Save` command maps the user object into a user table and stores the information as follow:

--------  -----------  ----------  -----
userid    username     password    age
--------  -----------  ----------  ------
1           am9lbA==  cGFzc3dvcmQ= 17

You’ll notice that the username and password variables have been escaped before they were saved whereas the age variable wasn’t. This happened because POG only escapes mixed data and leaves numeric data unescaped. By escaping mixed data for you, POG makes your web application more secure. This prevents injection type attacks on your web app.

We chose base64 because in our opinion, it’s the most convenient. It allows us to store and retrieve entire html pages to and from our database without breaking any sql statements. If we ever need to check what’s in the database, we use an online base64 decoder/encoder.

The beauty in all this I suppose is that you don’t have to use base64 to escape your information. There’s 2 function in the database class provided by POG: Escape($text) and Unescape($text) that you can modify to change how POG saves your information.

For example, if you want POG to save everything supplied to it as-is, simply comment out the contents of the functions. Or you can also make POG encrypt your information by using the PHP Crypt() function. The choice is yours.