Processing user input for a form I'm still learning PHP OOP, so I'd like to seek for some expert advice or criticism regarding this code I created.

In this script, I created the objects I need to process the user input from a form. While the $homepage object is responsible for displaying the whole webpage.

My questions are:


Is this consider clean code?
Can I completely hide the fact that I actually include the autoload and the configuration files?
Any recommendation or tips to improve my code?




&lt;?php

/**
*
* OOP practice
* @author Joey
*/

require_once 'config/autoload.php';
require_once 'config/config.php';

// Database credentials

$host = $config['host'];
$dbname = $config['dbname'];
$username = $config['username'];
$password = $config['password'];

// Short variable names

$fname = isset($_POST['fname']) ? clean_data($_POST['fname']) : null;
$lname = isset($_POST['lname']) ? clean_data($_POST['lname']) : null;
$your_question = isset($_POST['question']) ? clean_data($_POST['question']) : null;

try {

    // Page object

    $homepage = new Page('Questions and Answers', 'QA', '', 'You ask, we answer');

    // Author object

    $author = new Author($fname, $lname);

    // Question object

    $question = new Question($your_question, $author);

    // Database object

    $pdo = new DbConnect($host, $dbname, $username, $password);

    // Connect to the database

    $pdo-&gt;open_connection();
} catch (Exception $e) {
    echo $e-&gt;getMessage(), '&lt;br&gt;';
    exit;
} catch (PDOException $e) {
    echo $e-&gt;GetMessage(), '&lt;br&gt;';
    exit;
}

if (isset($_POST['submit'])) {
    // Insert the user input into the database

    $pdo-&gt;execute_query('INSERT INTO author (first_name, last_name) VALUES (?, ?)', array($author-&gt;getFirstName(), $author-&gt;GetLastName()));
    $pdo-&gt;close_connection();
    $homepage-&gt;content = '&lt;h3&gt;Your question&lt;/h3&gt;&lt;br&gt;&lt;p&gt;Hello ' . $author-&gt;getFirstName() . ' ' . $author-&gt;getLastName() . '!' . '&lt;/p&gt;&lt;br&gt;';
    $homepage-&gt;content .= '&lt;p&gt;You ask: ' . $question-&gt;getQuestion() . '&lt;/p&gt;&lt;br&gt;';
    $homepage-&gt;content .= 'Do you want to ';
    $homepage-&gt;content .= '&lt;a href="index.php"&gt;Ask another question?&lt;/a&gt;' . ' ' . '&lt;br&gt;';
} else {
    // Display the form

    $homepage-&gt;content = &lt;&lt;&lt;_END

    &lt;h3&gt;Your question here&lt;/h3&gt;&lt;br&gt;
    &lt;form action="{$_SERVER['PHP_SELF']}" method="post" role="form"&gt;
        &lt;label for="fname"&gt;Enter your first name&lt;/label&gt;&lt;br&gt;
     &lt;input type="text" id="fname" name="fname" size="30"&gt;&lt;br&gt;
        &lt;label for="lname"&gt;Enter your last name&lt;/label&gt;&lt;br&gt;
        &lt;input type="text" id="lname" name="lname" size="30"&gt;&lt;br&gt;
        &lt;label for="question"&gt;What is your question?&lt;/label&gt;&lt;br&gt;
        &lt;textarea id="question" name="question" rows="10" cols="70"&gt;&lt;/textarea&gt;&lt;br&gt;
        &lt;input type="submit" name="submit" value="Submit"&gt;
    &lt;/form&gt;
_END;
}

// Display the webpage using the Page class

$homepage-&gt;display();

function clean_data($data)
{
    $data = trim($data);
    $data = strip_tags($data);
    $data = addslashes($data);
    return $data;
}
A short list of issues I've noticed after a first glance at your code:


Pokemon exception handling (gotta catch 'em all): wrapping everything in a huge try-catch block is considered bad practice. What makes your code stand out even more is the pointless second catch
pointless second catch: a PDOException is a custom exception class, which is to say: PDOException extends Exception, therefore, your catch (Exception $e) block will catch instances of PDOExceptions, too. As a result, the second catch block is obsolete. Pointless. Code-smell. Noise. Get rid of it.
clean_data is not great. It's bad even. I can understand the strip_tags call, but addslashes is really rather pointless here. And a possible source of bugs. If you forget to call addslashes when inserting a password, or in some other piece of code that handles login information, the passwords in the DB won't match, even though the user has filled out the form correctly. You're using prepared statements, no need to add slashes. If anything, it does more harm than good
From the variable name ($pdo), it's quite obvious what kind of class DbConnect is. And, like I've posted on this site so many times (links below): it's evil. PDO offers a clean, well balanced, easy to use and powerful, fully object oriented API. You can't wrap it into something and end up with a better tool. Far from it. The only thing that you can do with it is to use it as a base in a fully-fledged DBAL like doctrine. And since doctrine already exists, writing it yourself is, basically, reinventing the wheel.
Generally, I don't like PHP code that strings together markup. It's error prone, and hard to maintain. That's why I didn't pay much attention to the HTML bit, but as tim pointed out: $_SERVER['PHP_SELF'] is a bad idea. If the form should be processed by the same script (or on the same url) that spawned it, just don't specify an action attribute. The default behavior is to post the form back to the same url anyway.


Links to previous answers explaining why you shouldn't try to wrap PDO:


Class for reducing development time
OOP PDO Database Connection
A PDO connection classto initiate multiple connection and easy access
Extendable PDO Wrapper Class
Check my profile, I'm pretty sure there are a lot more answers that deal with the matter, but I can't be bothered to look for every single one of them.