Safe alternatives to PHP Globals (Good Coding Practices)

Question

For years I have used global $var,$var2,...,$varn for methods in my application. I've used them for two main implementations:

Getting an already set class (such as DB connection), and passing info to functions that display to page.

Example:

$output['header']['log_out'] = "Log Out";
function showPage(){
     global $db, $output;
     $db = ( isset( $db ) ) ? $db : new Database();
     $output['header']['title'] = $db->getConfig( 'siteTitle' );
     require( 'myHTMLPage.html' );
     exit();
}

There are, however, performance and security ramifications of doing it like this.

What alternative practice can I use that will maintain my functionality but improve design, performance, and/or security?

This is the first question I've ever asked on SO, so if you need clarifications please comment!

Answer 1

The alternative is called dependency injection. In a nutshell it means that you pass the data a function/class/object requires as parameters.

function showPage(Database $db, array &$output) {
    ...
}


$output['header']['log_out'] = "Log Out";
$db = new Database;

showPage($db, $output);

This is better for a number of reasons:

• localizing/encapsulating/namespacing functionality (the function body has no implicit dependencies to the outside world anymore and vice versa, you can now rewrite either part without needing to rewrite the other as long as the function call doesn't change)
• allows unit testing, since you can test functions in isolation without needing to setup a specific outside world
• it's clear what a function is going to do to your code just by looking at the signature