I am developing an iphone app that uses a php web service for all functionalities. I am planning on creating model objects to communication between my UI and web service.
我正在开发一个使用php web服务实现所有功能的iphone应用程序。我正在计划创建模型对象以便在UI和Web服务之间进行通信。
Is it better to create model classes on php to communicate between my iphone models and database? or is it ok to communicate directly from database to my model classes for iphone?
在php上创建模型类以便在我的iphone模型和数据库之间进行通信是否更好？或者可以直接从数据库与我的iphone模型类进行通信？
Which one of the following is the correct way of handling this communication?
以下哪一项是处理此通信的正确方法？
- iphone-ui- => iphone-model-classes => web-service ==> database
- iphone-ui- => iphone-model-classes => web-service ==>数据库
- iphone-ui => iphone-model-classes => php-model-classes => web-service ==> database
- iphone-ui => iphone-model-classes => php-model-classes => web-service ==>数据库
1 个解决方案
#1
0
Why use PHP at all? Just use the relevant database library and connect to the database directly from the device!
为什么要使用PHP呢？只需使用相关的数据库库，直接从设备连接到数据库！
There are lots of reasons why you might want something sitting between the phone and the database server:
您可能想要在手机和数据库服务器之间放置一些东西的原因有很多：
- Authentication
- 认证
- Data validation/integrity checking
- 数据验证/完整性检查
- Logging/auditing
- 日志记录/审计
- Schema changes
- 架构更改
Full-fledged model classes may seem a bit heavyweight (especially since PHP doesn't cache anything), but you need to decide on how you want to do stuff on the server side. In particular, you might want to use model classes and a persistence layer to avoid dealing directly with Sqlite/MySQL/Postgres/ODBC/blah.
成熟的模型类可能看起来有点重量级（特别是因为PHP不会缓存任何东西），但是您需要决定如何在服务器端执行操作。特别是，您可能希望使用模型类和持久层来避免直接处理Sqlite / MySQL / Postgres / ODBC / blah。
There are also plenty of reasons why PHP isn't the best language for a web service...
PHP不是Web服务的最佳语言也有很多原因......
EDIT: I was playing Devil's Advocate.
编辑：我在玩Devil's Advocate。
A "connection" to a database is often just a TCP connection (though pretty much all modern POSIXish DBs support connecting via Unix sockets, which is somewhat more secure). You generally need to implement the DB's protocol; the easiest way is to use the DB-provided C library (libpq5 for Postgresql 8.4, libmysqlclient16 for MySQL 5.1, etc). I'm pretty sure that iOS doesn't include them by default (but IIRC old versions of OSX used to come with Postgres).
与数据库的“连接”通常只是一个TCP连接（尽管几乎所有现代POSIXish DB都支持通过Unix套接字连接，这有点更安全）。您通常需要实现DB的协议;最简单的方法是使用DB提供的C库（用于Postgresql 8.4的libpq5，用于MySQL 5.1的libmysqlclient16等）。我很确定默认情况下iOS不包含它们（但是IIRC旧版本的OSX曾经与Postgres一起提供）。
However, this is very bad for security reasons:
但是，出于安全原因，这非常糟糕：
- Most Linux distributions configure DB servers to only listen on Unix sockets (i.e. you can't connect to them via localhost). It's much easier to control access (only people who can access the file can connect), and allows for easy authentication as well (you can get the user ID of the process on the other end of the connection, which means you don't need passwords at all — this is the default config for Postgres).
- 大多数Linux发行版将数据库服务器配置为仅在Unix套接字上侦听（即，您无法通过localhost连接到它们）。控制访问更容易（只有可以访问文件的人才能连接），并且允许简单的身份验证（您可以在连接的另一端获取进程的用户ID，这意味着您不需要密码 - 这是Postgres的默认配置。
- Most configurations that allow connecting over TCP do so because Java DB libraries typically don't support Unix sockets (because a "pure Java" implementation supposedly has advantages, despite the tiny amount of native code you'd need to use Unix sockets). Typically these only allow connections from localhost (not random places on the internet).
- 大多数允许通过TCP连接的配置都是这样做的，因为Java DB库通常不支持Unix套接字（因为“纯Java”实现应该具有优势，尽管使用Unix套接字需要很少的本机代码）。通常，这些只允许来自localhost的连接（不是Internet上的随机位置）。
- If you're happy with the entire Internet having read-only access to the relevant tables, then it might be sensible. Otherwise, you'll want some sort of access control:
- Allowing the wider Internet to write to your database is bad. You can't just embed a password into your app; the app will be cracked within a few days/weeks and, if an attacker is sufficiently curious, the password will be extracted.
- 允许更广泛的Internet写入您的数据库是不好的。您不能只在您的应用中嵌入密码;该应用程序将在几天/几周内破解，如果攻击者足够好奇，将提取密码。
- Database access controls are per-DB or per-table, whereas you want to control access per-row (i.e. a user can see their own row in the "users" table, but not the row for other users).data for other users).
- 数据库访问控制是按每个数据库或每个表，而您希望控制每行访问（即用户可以在“users”表中看到自己的行，但不能看到其他用户的行）.data用于其他用户）。
- Databases servers typically don't do any form of rate-limiting on account logins, making it trivial to do an online bruteforce attack.
- 数据库服务器通常不对帐户登录进行任何形式的速率限制，这使得进行在线暴力攻击变得微不足道。
- 如果您对整个互联网对相关表具有只读权限感到满意，那么这可能是明智的。否则，您将需要某种访问控制：允许更广泛的Internet写入您的数据库是不好的。您不能只在您的应用中嵌入密码;该应用程序将在几天/几周内破解，如果攻击者足够好奇，将提取密码。数据库访问控制是按每个数据库或每个表，而您希望控制每行访问（即用户可以在“users”表中看到自己的行，但不能看到其他用户的行）.data用于其他用户）。数据库服务器通常不对帐户登录进行任何形式的速率限制，这使得进行在线暴力攻击变得微不足道。
And again, you very rarely want the phone to talk directly to the database. It means your app stops working when you update the schema (a no-no; you're not supposed to force users to upgrade). It might be possible to put together some views/triggers/etc as a compatibility layer. Icky.
而且，您很少希望手机直接与数据库通信。这意味着当您更新架构时，您的应用程序将停止工作（禁止使用;您不应强制用户升级）。可以将一些视图/触发器/等组合在一起作为兼容层。恶心。
Secondly, relational databases are generally a bad fit for what real apps do. You want to scroll down a table view. Each cell is loaded from a database row. Each row is loaded over the network ... ouch. (After using CoreData once, I never want to look back. It makes my life much easier. While I wouldn't use it on the server side (our servers run Debian and our webservices are mostly written in Python), if I'm going to write the app in Objective-C, Core Data doesn't add any more vendor lock-in — I don't know anyone who takes GNUstep seriously.
其次，关系数据库通常不适合真正的应用程序。您想向下滚动表格视图。每个单元格都从数据库行加载。每一行都通过网络加载......哎哟。 （使用CoreData一次之后，我再也不想回头了。它让我的生活变得更轻松。虽然我不会在服务器端使用它（我们的服务器运行Debian，而我们的web服务大多是用Python编写的），如果我是要在Objective-C中编写应用程序，Core Data不再添加任何供应商锁定 - 我不认识任何认真对待GNUstep的人。
Instead, it helps to consider the API you want to present to the web client. Most web services (Facebook, Twitter, probably others) seem to present a fairly "dumb", flat model of the world. Write the simplest thing that allows you implement the API you want. This might mean using model classes if it is sufficiently easy to do so (Google App Engine's modeling abstraction is nice; based off of Django's modeling abstraction, apparently).
相反，它有助于考虑您要呈现给Web客户端的API。大多数网络服务（Facebook，Twitter，可能是其他网站）似乎都呈现出一种相当“愚蠢”的平面世界模型。编写最简单的东西，允许您实现所需的API。这可能意味着如果它足够容易使用模型类（Google App Engine的建模抽象很好;基于Django的建模抽象，显然）。
#1
0
Why use PHP at all? Just use the relevant database library and connect to the database directly from the device!
为什么要使用PHP呢？只需使用相关的数据库库，直接从设备连接到数据库！
There are lots of reasons why you might want something sitting between the phone and the database server:
您可能想要在手机和数据库服务器之间放置一些东西的原因有很多：
- Authentication
- 认证
- Data validation/integrity checking
- 数据验证/完整性检查
- Logging/auditing
- 日志记录/审计
- Schema changes
- 架构更改
Full-fledged model classes may seem a bit heavyweight (especially since PHP doesn't cache anything), but you need to decide on how you want to do stuff on the server side. In particular, you might want to use model classes and a persistence layer to avoid dealing directly with Sqlite/MySQL/Postgres/ODBC/blah.
成熟的模型类可能看起来有点重量级（特别是因为PHP不会缓存任何东西），但是您需要决定如何在服务器端执行操作。特别是，您可能希望使用模型类和持久层来避免直接处理Sqlite / MySQL / Postgres / ODBC / blah。
There are also plenty of reasons why PHP isn't the best language for a web service...
PHP不是Web服务的最佳语言也有很多原因......
EDIT: I was playing Devil's Advocate.
编辑：我在玩Devil's Advocate。
A "connection" to a database is often just a TCP connection (though pretty much all modern POSIXish DBs support connecting via Unix sockets, which is somewhat more secure). You generally need to implement the DB's protocol; the easiest way is to use the DB-provided C library (libpq5 for Postgresql 8.4, libmysqlclient16 for MySQL 5.1, etc). I'm pretty sure that iOS doesn't include them by default (but IIRC old versions of OSX used to come with Postgres).
与数据库的“连接”通常只是一个TCP连接（尽管几乎所有现代POSIXish DB都支持通过Unix套接字连接，这有点更安全）。您通常需要实现DB的协议;最简单的方法是使用DB提供的C库（用于Postgresql 8.4的libpq5，用于MySQL 5.1的libmysqlclient16等）。我很确定默认情况下iOS不包含它们（但是IIRC旧版本的OSX曾经与Postgres一起提供）。
However, this is very bad for security reasons:
但是，出于安全原因，这非常糟糕：
- Most Linux distributions configure DB servers to only listen on Unix sockets (i.e. you can't connect to them via localhost). It's much easier to control access (only people who can access the file can connect), and allows for easy authentication as well (you can get the user ID of the process on the other end of the connection, which means you don't need passwords at all — this is the default config for Postgres).
- 大多数Linux发行版将数据库服务器配置为仅在Unix套接字上侦听（即，您无法通过localhost连接到它们）。控制访问更容易（只有可以访问文件的人才能连接），并且允许简单的身份验证（您可以在连接的另一端获取进程的用户ID，这意味着您不需要密码 - 这是Postgres的默认配置。
- Most configurations that allow connecting over TCP do so because Java DB libraries typically don't support Unix sockets (because a "pure Java" implementation supposedly has advantages, despite the tiny amount of native code you'd need to use Unix sockets). Typically these only allow connections from localhost (not random places on the internet).
- 大多数允许通过TCP连接的配置都是这样做的，因为Java DB库通常不支持Unix套接字（因为“纯Java”实现应该具有优势，尽管使用Unix套接字需要很少的本机代码）。通常，这些只允许来自localhost的连接（不是Internet上的随机位置）。
- If you're happy with the entire Internet having read-only access to the relevant tables, then it might be sensible. Otherwise, you'll want some sort of access control:
- Allowing the wider Internet to write to your database is bad. You can't just embed a password into your app; the app will be cracked within a few days/weeks and, if an attacker is sufficiently curious, the password will be extracted.
- 允许更广泛的Internet写入您的数据库是不好的。您不能只在您的应用中嵌入密码;该应用程序将在几天/几周内破解，如果攻击者足够好奇，将提取密码。
- Database access controls are per-DB or per-table, whereas you want to control access per-row (i.e. a user can see their own row in the "users" table, but not the row for other users).data for other users).
- 数据库访问控制是按每个数据库或每个表，而您希望控制每行访问（即用户可以在“users”表中看到自己的行，但不能看到其他用户的行）.data用于其他用户）。
- Databases servers typically don't do any form of rate-limiting on account logins, making it trivial to do an online bruteforce attack.
- 数据库服务器通常不对帐户登录进行任何形式的速率限制，这使得进行在线暴力攻击变得微不足道。
- 如果您对整个互联网对相关表具有只读权限感到满意，那么这可能是明智的。否则，您将需要某种访问控制：允许更广泛的Internet写入您的数据库是不好的。您不能只在您的应用中嵌入密码;该应用程序将在几天/几周内破解，如果攻击者足够好奇，将提取密码。数据库访问控制是按每个数据库或每个表，而您希望控制每行访问（即用户可以在“users”表中看到自己的行，但不能看到其他用户的行）.data用于其他用户）。数据库服务器通常不对帐户登录进行任何形式的速率限制，这使得进行在线暴力攻击变得微不足道。
And again, you very rarely want the phone to talk directly to the database. It means your app stops working when you update the schema (a no-no; you're not supposed to force users to upgrade). It might be possible to put together some views/triggers/etc as a compatibility layer. Icky.
而且，您很少希望手机直接与数据库通信。这意味着当您更新架构时，您的应用程序将停止工作（禁止使用;您不应强制用户升级）。可以将一些视图/触发器/等组合在一起作为兼容层。恶心。
Secondly, relational databases are generally a bad fit for what real apps do. You want to scroll down a table view. Each cell is loaded from a database row. Each row is loaded over the network ... ouch. (After using CoreData once, I never want to look back. It makes my life much easier. While I wouldn't use it on the server side (our servers run Debian and our webservices are mostly written in Python), if I'm going to write the app in Objective-C, Core Data doesn't add any more vendor lock-in — I don't know anyone who takes GNUstep seriously.
其次，关系数据库通常不适合真正的应用程序。您想向下滚动表格视图。每个单元格都从数据库行加载。每一行都通过网络加载......哎哟。 （使用CoreData一次之后，我再也不想回头了。它让我的生活变得更轻松。虽然我不会在服务器端使用它（我们的服务器运行Debian，而我们的web服务大多是用Python编写的），如果我是要在Objective-C中编写应用程序，Core Data不再添加任何供应商锁定 - 我不认识任何认真对待GNUstep的人。
Instead, it helps to consider the API you want to present to the web client. Most web services (Facebook, Twitter, probably others) seem to present a fairly "dumb", flat model of the world. Write the simplest thing that allows you implement the API you want. This might mean using model classes if it is sufficiently easy to do so (Google App Engine's modeling abstraction is nice; based off of Django's modeling abstraction, apparently).
相反，它有助于考虑您要呈现给Web客户端的API。大多数网络服务（Facebook，Twitter，可能是其他网站）似乎都呈现出一种相当“愚蠢”的平面世界模型。编写最简单的东西，允许您实现所需的API。这可能意味着如果它足够容易使用模型类（Google App Engine的建模抽象很好;基于Django的建模抽象，显然）。