PHP Inheritance: The Protected Property That Broke the CMS

<?php

// Parent class — defines everything ALL content types share
class Content
{
    protected string $title;      // protected = visible to child classes
    protected string $author;
    protected string $publishedAt;

    public function __construct(string $title, string $author, string $publishedAt)
    {
        $this->title       = $title;
        $this->author      = $author;
        $this->publishedAt = $publishedAt;
    }

    // Any child class can call or override this
    public function getSummaryLine(): string
    {
        return "'{$this->title}' by {$this->author} — published {$this->publishedAt}";
    }

    public function getAuthor(): string
    {
        return $this->author;
    }
}

// Child class — inherits everything above, adds word count
class Article extends Content
{
    private int $wordCount;

    public function __construct(
        string $title,
        string $author,
        string $publishedAt,
        int $wordCount
    ) {
        // MUST call parent constructor to initialise $title, $author, $publishedAt
        parent::__construct($title, $author, $publishedAt);

        // Now handle Article-specific setup
        $this->wordCount = $wordCount;
    }

    public function getReadingTime(): string
    {
        // Average adult reads ~238 words per minute
        $minutes = (int) ceil($this->wordCount / 238);
        return "{$minutes} min read";
    }
}

// --- Usage ---
$article = new Article(
    title:       'Understanding PHP Closures',
    author:      'Dana Walsh',
    publishedAt: '2024-11-01',
    wordCount:   1190
);

// Method inherited directly from Content — no copy-paste needed
echo $article->getSummaryLine() . PHP_EOL;

// Method defined on Article itself
echo $article->getReadingTime() . PHP_EOL;

// Works because getAuthor() is inherited
echo 'Author: ' . $article->getAuthor() . PHP_EOL;

<?php

class Content
{
    protected string $title;
    protected string $author;
    protected string $publishedAt;

    public function __construct(string $title, string $author, string $publishedAt)
    {
        $this->title       = $title;
        $this->author      = $author;
        $this->publishedAt = $publishedAt;
    }

    // Base version — returns the standard summary
    public function getSummaryLine(): string
    {
        return "'{$this->title}' by {$this->author} — published {$this->publishedAt}";
    }
}

class Article extends Content
{
    private int $wordCount;

    public function __construct(string $title, string $author, string $publishedAt, int $wordCount)
    {
        parent::__construct($title, $author, $publishedAt);
        $this->wordCount = $wordCount;
    }

    // Override: article summary adds word count
    public function getSummaryLine(): string
    {
        // Reuse the parent's format, then append article-specific info
        $baseSummary = parent::getSummaryLine();
        return "{$baseSummary} [{$this->wordCount} words]";
    }
}

class Podcast extends Content
{
    private int $durationInSeconds;

    public function __construct(string $title, string $author, string $publishedAt, int $durationInSeconds)
    {
        parent::__construct($title, $author, $publishedAt);
        $this->durationInSeconds = $durationInSeconds;
    }

    // Override: podcast summary adds formatted duration
    public function getSummaryLine(): string
    {
        $baseSummary      = parent::getSummaryLine(); // reuse, don't rewrite
        $formattedMinutes = floor($this->durationInSeconds / 60);
        $formattedSeconds = $this->durationInSeconds % 60;
        $duration         = sprintf('%d:%02d', $formattedMinutes, $formattedSeconds);

        return "{$baseSummary} [Duration: {$duration}]";
    }
}

// --- Polymorphism in action ---
// Both are Content objects — same method call, different output
$contentItems = [
    new Article('Mastering SQL Joins', 'Priya Mehta', '2024-10-15', 2040),
    new Podcast('The PHP Roundtable Ep.12', 'Leo Fischer', '2024-10-22', 2754),
];

foreach ($contentItems as $item) {
    // PHP calls the RIGHT getSummaryLine() based on the actual object type
    echo $item->getSummaryLine() . PHP_EOL;
}

<?php

class User
{
    private   string $passwordHash;    // ONLY accessible inside User — not even children
    protected string $email;           // Accessible in User and all child classes
    public    string $displayName;     // Accessible from anywhere

    public function __construct(string $displayName, string $email, string $plainPassword)
    {
        $this->displayName  = $displayName;
        $this->email        = $email;
        $this->passwordHash = password_hash($plainPassword, PASSWORD_BCRYPT); // stored hashed
    }

    public function verifyPassword(string $plainPassword): bool
    {
        // Only User itself handles the private passwordHash — child classes can't touch it
        return password_verify($plainPassword, $this->passwordHash);
    }

    protected function getFormattedEmail(): string
    {
        // Protected helper — child classes can reuse this logic
        return strtolower(trim($this->email));
    }
}

class AdminUser extends User
{
    private string $adminRole;

    public function __construct(string $displayName, string $email, string $plainPassword, string $adminRole)
    {
        parent::__construct($displayName, $email, $plainPassword);
        $this->adminRole = $adminRole;
    }

    public function getAdminSummary(): string
    {
        // Can access protected $email via the inherited protected method
        $formattedEmail = $this->getFormattedEmail();

        // Can access public $displayName directly
        return "{$this->displayName} ({$formattedEmail}) — Role: {$this->adminRole}";

        // This would cause a fatal error — private property of parent:
        // return $this->passwordHash;  // ERROR: Cannot access private property
    }
}

// Multi-level: SuperAdmin extends AdminUser extends User
class SuperAdmin extends AdminUser
{
    public function __construct(string $displayName, string $email, string $plainPassword)
    {
        // SuperAdmin always has the 'super' role — enforced here
        parent::__construct($displayName, $email, $plainPassword, 'super');
    }

    public function impersonateUser(string $targetEmail): string
    {
        return "{$this->displayName} is now acting as: {$targetEmail}";
    }
}

// --- Usage ---
$admin      = new AdminUser('Sara Okafor', 'Sara@Example.com', 'securePass99', 'editor');
$superAdmin = new SuperAdmin('Dev Master', 'dev@example.com', 'rootPass123');

echo $admin->getAdminSummary() . PHP_EOL;
echo $superAdmin->getAdminSummary() . PHP_EOL;
echo $superAdmin->impersonateUser('customer@example.com') . PHP_EOL;

// Password verification still works — the private hash logic lives in the base class
$loginOk = $admin->verifyPassword('securePass99');
echo 'Login valid: ' . ($loginOk ? 'Yes' : 'No') . PHP_EOL;

<?php

// Abstract class — provides shared logic, demands child-specific implementations
abstract class Content
{
    protected string $title;
    protected string $author;
    protected string $publishedAt;

    public function __construct(string $title, string $author, string $publishedAt)
    {
        $this->title       = $title;
        $this->author      = $author;
        $this->publishedAt = $publishedAt;
    }

    // Concrete shared method — all children inherit this as-is
    public function getByline(): string
    {
        return "By {$this->author} on {$this->publishedAt}";
    }

    // Abstract method — every child MUST provide its own implementation
    // PHP enforces this at class-load time, not at runtime
    abstract public function getMediaType(): string;

    abstract public function renderPreview(): string;
}

// Concrete child — MUST implement both abstract methods or PHP throws a fatal error
class VideoContent extends Content
{
    private int $durationInSeconds;
    private string $thumbnailUrl;

    public function __construct(
        string $title,
        string $author,
        string $publishedAt,
        int $durationInSeconds,
        string $thumbnailUrl
    ) {
        parent::__construct($title, $author, $publishedAt);
        $this->durationInSeconds = $durationInSeconds;
        $this->thumbnailUrl      = $thumbnailUrl;
    }

    // Fulfils the abstract contract
    public function getMediaType(): string
    {
        return 'video';
    }

    public function renderPreview(): string
    {
        $mins = floor($this->durationInSeconds / 60);
        $secs = $this->durationInSeconds % 60;
        return "[VIDEO] {$this->title} ({$mins}m {$secs}s) — thumb: {$this->thumbnailUrl}";
    }
}

class WrittenArticle extends Content
{
    private int $wordCount;

    public function __construct(string $title, string $author, string $publishedAt, int $wordCount)
    {
        parent::__construct($title, $author, $publishedAt);
        $this->wordCount = $wordCount;
    }

    public function getMediaType(): string
    {
        return 'article';
    }

    public function renderPreview(): string
    {
        return "[ARTICLE] {$this->title} — {$this->wordCount} words";
    }
}

// --- This would throw: Cannot instantiate abstract class Content ---
// $raw = new Content('Test', 'Someone', '2024-01-01');

$video   = new VideoContent('Async PHP Deep Dive', 'Yuki Tanaka', '2024-09-10', 1845, '/thumbs/async-php.jpg');
$article = new WrittenArticle('PHP 8.3 New Features', 'Amara Diallo', '2024-09-18', 3200);

$contentFeed = [$video, $article];

foreach ($contentFeed as $piece) {
    // getByline() is inherited — same for all
    echo $piece->getByline() . PHP_EOL;

    // renderPreview() — each type handles this its own way
    echo $piece->renderPreview() . PHP_EOL;
    echo str_repeat('-', 50) . PHP_EOL;
}

<?php

// BAD: Inheritance violates Liskov substitution
class ReadOnlyListInherited extends SplFixedArray
{
    public function offsetSet($index, $newval): void
    {
        throw new \BadMethodCallException('Read-only list cannot be modified');
    }
}

// GOOD: Composition delegates only desired behaviour
class ReadOnlyList
{
    private array $items;

    public function __construct(array $items)
    {
        $this->items = $items;
    }

    public function get(int $index): mixed
    {
        return $this->items[$index] ?? null;
    }

    public function count(): int
    {
        return count($this->items);
    }

    // Expose only read methods
}

// Usage
$readOnly = new ReadOnlyList(['a', 'b', 'c']);
echo $readOnly->get(1) . PHP_EOL; // b
// No add, no set — safe by design

// io.thecodeforge — php tutorial

// This will fail at runtime because the child violates LSP

class PaymentGateway
{
    public function charge(float $amount, string $currency): string
    {
        return sprintf('Charged %.2f %s', $amount, $currency);
    }
}

class StripeGateway extends PaymentGateway
{
    // Violates contravariance: parameter $currency is now nullable
    // Violates covariance: return type changed from string to int
    public function charge(float $amount, ?string $currency = null): int
    {
        $currency ??= 'USD';
        return (int) parent::charge($amount, $currency);
    }
}

$processor = new PaymentGateway();
echo $processor->charge(100, 'EUR'); // Works

$processor = new StripeGateway();
echo $processor->charge(50, 'GBP'); // Returns int, not string

// io.thecodeforge — php tutorial

// Using final to prevent dangerous extension

final class CryptoService
{
    public function __construct(private string $key) {}

    final public function encrypt(string $plain): string
    {
        return openssl_encrypt($plain, 'aes-256-gcm', $this->key, 0, $iv = random_bytes(12), $tag);
    }

    final public function decrypt(string $cipher): string
    {
        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $this->key, 0, $iv, $tag);
        return $plain !== false ? $plain : throw new \RuntimeException('Decryption failed');
    }
}

// This will fail
class EvilCrypto extends CryptoService {}

echo (new CryptoService('my-32-byte-secret-key-1234567890'))->encrypt('sensitive data');