AI blog · DotApp PHP Framework 2.0

Request lifecycle in DotApp PHP Framework

After boot, every HTTP hit is a RequestObj passed into the controller as $request. Incoming GET/POST is auto-protected so a forgotten sanitizer does not open XSS / injection-era holes. That is why Request has an explicit switch: data() is the escaped copy; data(true) is the original. This article is the map: how the body is collected, when to ask for original values, query() vs matchData(), crcCheck(), form(), and why HTTP 400 never reaches form .after().

Request data: protected vs original

Common mistakes

What arrives on the request

The constructor parses the body once and caches it. GET uses $_GET. POST uses $_POST, falling back to JSON or parse_str on php://input. PUT / PATCH / DELETE parse the raw body the same way. HEAD / OPTIONS are empty.

There is no headers() method. Uploads use $request->upload() — not crcCheck() on that endpoint. Full forms: How to create secure forms. Auth passwords: Authentication and 2FA.

Channel posts

Browser Shop posts ride /assets/dotapp/dotapp.js: { data, crc } plus header dotapp: load. PHP: crcCheck() first. Then form(['POST'], 'saveContact', ok, err) for a named form, or read $request->data(true)['data'] for a load() / Bridge payload. Always provide the form error callback. A mismatch without it throws. Handler / URL mismatch returns null. Method mismatch returns false.

if (!$request->crcCheck()) {
    return DotApp::DotApp()->ajaxReply(['status' => 0, 'message' => 'Bad request'], 400);
}
$answer = $request->form(['POST'], 'saveContact', function ($request) {
    $data = $request->data(true)['data'] ?? [];
    $email = (string) ($data['email'] ?? '');
    // persist with named RAW — values in the second argument
    return ['code' => 200, 'body' => ['status' => 1, 'message' => 'Saved']];
}, function () {
    return ['code' => 403, 'body' => ['status' => 0, 'message' => 'Invalid signature']];
});
if (!is_array($answer) || !isset($answer['body'])) {
    return DotApp::DotApp()->ajaxReply(['status' => 0, 'message' => 'Rejected'], 400);
}
return DotApp::DotApp()->ajaxReply($answer['body'], $answer['code']);
    

What the controller returns

Channel UI uses ajaxReply. Public JSON APIs use Router + Response::json. Routing: How routing works.

Complete Shop save handler

File: app/modules/Shop/Controllers/Contact.php — the POST half. Read original fields, validate, persist with named RAW, answer with ajaxReply.

<?php
namespace Dotsystems\App\Modules\Shop\Controllers;

use Dotsystems\App\DotApp;
use Dotsystems\App\Parts\DB;
use Dotsystems\App\Parts\Logger;
use Dotsystems\App\Parts\Validator;

class Contact extends \Dotsystems\App\Parts\Controller
{
    public static function save($request)
    {
        if (!$request->crcCheck()) {
            return DotApp::DotApp()->ajaxReply(['status' => 0, 'message' => 'Bad request'], 400);
        }

        $answer = $request->form(
            ['POST'],
            'saveContact',
            function ($request) {
                $data = $request->data(true)['data'] ?? [];
                $email = trim((string) ($data['email'] ?? ''));
                $message = (string) ($data['message'] ?? '');
                if (!Validator::isEmail($email) || $message === '') {
                    return ['code' => 200, 'body' => [
                        'status' => 0, 'message' => 'Enter a valid email and a message',
                    ]];
                }
                DB::module('RAW')->q(function ($qb) use ($email, $message) {
                    $qb->raw(
                        'INSERT INTO shop_contacts (email, message, created_at)
                         VALUES (:email, :message, :created_at)',
                        [
                            'email' => $email,
                            'message' => $message,
                            'created_at' => date('Y-m-d H:i:s'),
                        ]
                    );
                })->execute(
                    function () {},
                    function ($error) { Logger::use()->error('contact save failed', $error); }
                );
                return ['code' => 200, 'body' => ['status' => 1, 'message' => 'Saved']];
            },
            function () {
                return ['code' => 403, 'body' => ['status' => 0, 'message' => 'Invalid signature']];
            }
        );

        if (!is_array($answer) || !isset($answer['body'])) {
            return DotApp::DotApp()->ajaxReply(['status' => 0, 'message' => 'Rejected'], 400);
        }
        return DotApp::DotApp()->ajaxReply($answer['body'], $answer['code']);
    }
}