What are the potential pitfalls of transitioning to OOP in PHP, and where should input validation be performed?

One potential pitfall of transitioning to OOP in PHP is the lack of proper input validation, which can lead to security vulnerabilities such as SQL injection or cross-site scripting attacks. Input validation should be performed at the earliest point in the code where the data is received, typically in the constructor or setter methods of the class. 

class User {
    private $username;

    public function __construct($username) {
        $this->setUsername($username);
    }

    public function setUsername($username) {
        // Perform input validation here
        if (!preg_match('/^[a-zA-Z0-9]{5,20}$/', $username)) {
            throw new Exception('Invalid username format');
        }

        $this->username = $username;
    }
}

Related Questions