Question

From what I know, checking preconditions is a good practice. If a method needs an int value then it’s a good solution to do use something like this:

public function sum($input1, $input2) {
if (!is_int($input1)) throw new Exception('Input must be a integer');

However after looking to the source code of Zend/Codeigniter I don’t see checks like this very often. Is there a reason for this ?

Answer 1

Because it is difficult / inefficient to test each and every variable before you use it. Instead they check just input variables – check visitors at the door, not once inside the house.

It is of course a good defensive programming technique to test at least more important vars before using them, especially if the input comes from many places.

This is a bit off-topic, but the solution I would recommend is to test input variables like this:

$username=get('username', 'string');
$a=get('a', 'int');
...

$_REQUEST and similar should never be used (or even be accessible) directly.

Also, when doing HTML output, you should always use this:

echo html($username); // replaces '<' with '&lt;' - uses htmlentities

To avoid SQL injection attacks one can use MeekroDB, but it is unfortunately very limiting (MySQL only, single DB only,…). It has a good API though which promotes safety, so I would recommend checking it out.
For myself I have build a small DB library that is based on PDO and uses prepared statements. YMMV.