How to inspect every query going to DB from Zend Framework

Question

I have a complex reporting application that allows clients to login and view reports for their client data. There are several sections of the application where there are database calls, using various controllers. I need to make sure that client A doesn't get client B's information via header manipulation.

The system authenticates, and assignes them a clientID and roleID. If your roleID >1, that means you work for the company hosting the data, and you can see all client info. I want to create a catch-all that basically works like this:

    if($roleID > 1) {

    ...send query to database

   }else {
     if(...does this query select a record with clientID other than my $auth->clientID){
     do not execute query
  }else {
   execute query
   }
}

The problem is, I want this to run for every query that goes to the server... how can I place this code as a "roadblock" between the application and the DB? I already use Zend_Profiler to look at queries, so I know it is somehow possible, but cannot discern this from the Profiler code...

I can always write an authentication function and pass selected queries that way, but this catch-all would be easier to implement across all of the calls and would be future proof. Any help is appreciated.

I tend to use ZFdebug toolbar , its very helpfull [Database: Full listing of SQL queries and the time for each] jokke.dk/software/zfdebug — tawfekov
– tawfekov, Commented Jul 29, 2011 at 17:24

SMka · Accepted Answer · 2011-07-29 17:57:53Z

1

it's application design fault. you shoud use 'service architecture' - the only one entry point for queries would be a service. and any checks inside it.

answered Jul 29, 2011 at 17:57

SMka

3,02119 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

CookiesBoxcar Over a year ago

not sure I understand... i thought Zend Framework was acting as a pseudo - service?

H Hatfield · Accepted Answer · 2011-07-29 21:05:46Z

1

If this is something you want run on every query, I'd suggest extending Zend_Db_Select and overwrite either the query() or assemble() functions to add in your logic. You'll also want to add a way for it to be aware of your $auth object.

answered Jul 29, 2011 at 21:05

H Hatfield

8465 silver badges9 bronze badges

Comments

Adrian Schneider · Accepted Answer · 2011-07-29 21:09:24Z

1

Another option is to extend your database adapter so you can intercept the queries directly. IMO, you should try and do this at the application level though.

answered Jul 29, 2011 at 21:09

Adrian Schneider

7,4791 gold badge21 silver badges14 bronze badges

Comments

Jeffrey Kevin Pry · Accepted Answer · 2011-07-29 17:00:29Z

0

Depending on your database server, you can put a trace on the DB side.

Here's an example for Oracle:

http://orafaq.com/wiki/SQL_Trace

answered Jul 29, 2011 at 17:00

Jeffrey Kevin Pry

3,2963 gold badges38 silver badges67 bronze badges

Collectives™ on Stack Overflow

How to inspect every query going to DB from Zend Framework

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related