PDO : injection par réflexion et méthodes magiques

/* Alors c’est facile, yaka créer une classe parente */
class Entity
{
    /* avec le getter qui va bien */
    public function __get($name)
    {
        if (isset($this->$name)) {
            /* et puis là on peut bricoler les données */
            return $this->$name;
        }
    }

    /* après on fait pareil avec le setter */
    public function __set($name, $value)
    {
        if (isset($this->$name)) {
            /* et on peut aussi bricoler les données */
            $this->$name = $value;
        } else if (false !== strpos($name, '_')) {
            /* et traduire le snake_case en camelCase */
            $this->__set($this->snakeCaseToCamelCase($name), $value);
        }
    }

    /* et on implémente vite fait mal fait une méthode pour traduire le
       snake_case en camelCase (sérieusement, n’utilisez pas ça) */
    protected function snakeCaseToCamelCase($str)
    {
        $upperCamelCase = str_replace('_', '', ucwords($str, '_'));

        return strtolower(substr($upperCamelCase, 0, 1)) . substr($upperCamelCase, 1);
    }
}

/* et puis on implémente les entités */
class User extends Entity
{
    /* et on leur ajoute les propriétés qui vont bien */
    protected $email = '';
    protected $firstName = '';
}

try {
    /* et puis du coup on teste vite fait avec une base SQLite en RAM */
    $dbh = new PDO('sqlite::memory:');
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $dbh->exec('CREATE TABLE `users` (`email` TEXT, `first_name` TEXT)');
    $dbh->exec('INSERT INTO `users` VALUES ("alice@example.org", "Alice")');
    $dbh->exec('INSERT INTO `users` VALUES ("bob@example.org", "Bob" )');

    $stmt = $dbh->prepare('SELECT * FROM `users` LIMIT 1');
    $stmt->setFetchMode(PDO::FETCH_CLASS, 'User');
    $stmt->execute();

    /* et voilà, terminé, ça marche, j’vois pas pourquoi
       il nous casse les pieds avec son roman l’autre ! */
    var_dump($stmt->fetch());

    /*
      class User#3 (2) {
        protected $email =>
        string(17) "alice@example.org"
        protected $firstName =>
        string(5) "Alice"
      }
    */
} catch (Exception $e) {
    die($e->getMessage());
}

/* User */
public function __set($name, $value)
{
    var_dump($name);

    /*
      1. string(10) "first_name"
      2. string(9) "firstName"
    */

    parent::__set($name, $value);
}

namespace MyApp\Model\Utility;

use \Respect\Validation\Validator;

/**
 * Entity
 *
 * Provides virtually protected properties as a workaround to avoid conflicts
 * between PDO's reflection injection and magic methods.
 */
trait EntityTrait
{
    /**
     * Properties
     *
     * Classes should never access this array directly.
     *
     * @var mixed[]
     */
    protected $hiddenProperties = [];

    /**
     * {@inheritdoc}
     *
     * @param string $name The name of the property
     *
     * @return bool
     */
    public function __isset($name)
    {
        return $this->hasProperty($name);
    }

    /**
     * {@inheritdoc}
     *
     * @param string $name The name of the property
     *
     * @return mixed
     */
    public function __get($name)
    {
        return $this->getPropertyValue($name);
    }

    /**
     * {@inheritdoc}
     *
     * This method can use aliases.
     *
     * @param string $name The name of the property
     * @param mixed $value The value of the property
     */
    public function __set($name, $value)
    {
        $this->setPropertyValue($name, $value);
    }

    /**
     * Get the list of virtual properties
     *
     * @abstract
     *
     * @return string[] Defined properties
     */
    abstract protected function getProperties();

    /**
     * Get the list of virtual properties aliases
     *
     * Aliases are usefull to bind database columns names to class properties.
     *
     * @return string[] An array of `alias => property`
     */
    protected function getPropertiesAliases()
    {
        return [];
    }

    /**
     * Get the list of properties validators
     *
     * ```
     * return [
     *     'id'       => Validator::intType()->positive(),
     *     'password' => Validator::alnum()->notEmpty(),
     * ]
     * ```
     *
     * @see EntityTrait::setPropertyValue()
     *
     * @return Validator[]
     */
    protected function getPropertiesValidators()
    {
        return [];
    }

    /**
     * Get the value of a given property
     *
     * @param string $name The name of the property
     *
     * @return mixed
     */
    protected function getPropertyValue($name)
    {
        if (isset($this->hiddenProperties[$name])) {
            return $this->hiddenProperties[$name];
        }
    }

    /**
     * Check if a property is defined
     *
     * @param string $name The name of the property
     *
     * @return bool
     */
    protected function hasProperty($name)
    {
        return in_array($name, $this->getProperties());
    }

    /**
     * Check if a property has a validator
     *
     * @param string $name The name of the property
     *
     * @return bool
     */
    protected function hasPropertyValidator($name)
    {
        $validators = $this->getPropertiesValidators();

        if (!empty($validators[$name])) {
            $validator = $validators[$name];

            return is_object($validator) && $validator instanceof Validator;
        }

        return false;
    }

    /**
     * Get the real name of an aliased property
     *
     * @param string $name Alias to resolve
     *
     * @return string
     */
    protected function resolvePropertyName($name)
    {
        if ($this->hasProperty($name)) {
            return $name;
        }

        $aliases = $this->getPropertiesAliases();

        if (isset($aliases[$name]) && $this->hasProperty($aliases[$name])) {
            return $aliases[$name];
        }
    }

    /**
     * Set the value of a property
     *
     * This method can use aliases.
     *
     * @param string $name The name of the property
     * @param mixed $value The value of the property
     */
    protected function setPropertyValue($name, $value)
    {
        $name = $this->resolvePropertyName($name);

        if ($name && $this->validatePropertyValue($name, $value)) {
            $this->hiddenProperties[$name] = $value;
        }
    }

    /**
     * Validate the value of a property
     *
     * @param string $name The name of the property
     * @param mixed $value The value of the property
     *
     * @return bool Is the value valid?
     */
    protected function validatePropertyValue($name, $value)
    {
        if (!$this->hasProperty($name)) {
            return false;
        }

        if (!$this->hasPropertyValidator($name)) {
            return true;
        }

        return $this->getPropertiesValidators()[$name]->validate($value);
    }
}

namespace MyApp\Model\Entity;

use \MyApp\Model\Utility;
use \Respect\Validation\Validator;

class User
{
    use Utility\EntityTrait;

    protected function getProperties()
    {
        return [ 'email', 'firstName' ];
    }

    protected function getPropertiesAliases()
    {
        return [ 'first_name' => 'firstName' ];
    }

    protected function getPropertiesValidators()
    {
        return [ 'email' => Validator::optional(Validator::email()) ];
    }
}

try {
    $dbh = new PDO('sqlite::memory:');
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $dbh->exec('CREATE TABLE `users` (`email` TEXT, `first_name` TEXT)');
    $dbh->exec('INSERT INTO `users` VALUES ("alice@example.org", "Alice")');
    $dbh->exec('INSERT INTO `users` VALUES ("incorrect_email", "Bob")');

    $stmt = $dbh->prepare('SELECT * FROM `users`');
    $stmt->execute();

    $users = $stmt->fetchAll(PDO::FETCH_CLASS, MyApp\Model\Entity\User::class);

    var_dump($users);

    /*
      array(2) {
        [0] =>
        class MyApp\Model\Entity\User#4 (1) {
          protected $hiddenProperties =>
          array(2) {
            'email' =>
            string(17) "alice@example.org"
            'firstName' =>
            string(5) "Alice"
          }
        }
        [1] =>
        class MyApp\Model\Entity\User#9 (1) {
          protected $hiddenProperties =>
          array(1) {
            'firstName' =>
            string(3) "Bob"
          }
        }
      }
      */
} catch (Exception $e) {
    die($e->getMessage());
}