When to use Object->SaveNew()

While designing Php Object Generator, we wanted the Save() function to be ‘smart enough’ to know when to UPDATE a database record and when to do an INSERT. POG uses the objectId attribute to make this decision. The objectId attribute is an auto-increment field, which is automatically generated for all objects. The objectId is also by default, the primary key of the object. For more information, check out the Save CRUD method section of the tutorials. If the objectId is empty, POG will save the object to the database and assign the objectId after the INSERT. Upon subsequent calls to the Save() CRUD method of the same object, POG will UPDATE the corresponding row of the database. Therefore, using Save() does the job in almost all scenarios. Why then do we need the SaveNew() CRUD method?

There are specific situations where you want to force a database INSERT and this is when SaveNew() comes in handy. There are 2 main situations I can think of: The first one is when you want to clone an object within the database. In other words, you simply want to duplicate a row of your the database. The second is security. SaveNew() guards against unintentionally updating a database record with corrupt data. A rare and specific way this could happen is if, for example, you’ve created a user registration form whose input field names match the attribute names of your object, and in your code, you’re looping through the $_POST array and matching the input fields to attributes of your object as follows:

$keys = array_keys($_POST);
foreach ($keys as $key)
{
$user->{$key} = (isset($_POST[$key]) ? $_POST[$key] : ‘’);
}
$user->Save();

Someone could potentially create their own web form containing an input field called “userId” and perform a cross-domain POST to your script. The code above would grab the objectId value and assign it to the object. Upon Save(), POG will overwrite an existing record. This specific scenario can be avoided by using SaveNew() as follows:

$keys = array_keys($_POST);
foreach ($keys as $key)
{
$user->{$key} = (isset($_POST[$key]) ? $_POST[$key] : ‘’);
}
$user->SaveNew();

In the case of a user registration system or whenever the application logic dictates that only an INSERT (no UPDATE) should be performed, SaveNew() is the safer choice.