Breakable MVC framework written in PHP I've written a framework in MVC. I call it Midget MVC, as it's so darn small. The reason I wrote it is because I wanted a lightweight and extensible framework to use in projects. It eventually got abandoned due to it's break-ability and my lack of experience in the subject. However, I've got a bigger project I'm working on and need a framework, so I want to start re-writing MMVC. Feel free to view the entire project here. 

The main piece of code I want looked over is the router class. After talking a bit on the PHP I discovered that it was indeed breakable. One of the recommendations made was for me not to use global $config. What's the best way to do this? 

&lt;?php

class Route {
    public function load(){
        global $config;
        if(isset($_SERVER['PATH_INFO'])){
            $route = explode('/', substr($_SERVER['PATH_INFO'], 1));
            $controller = ucfirst(strtolower($route[0]));
            $method = isset($route[1]) ? strtolower($route[1]) : 'index';

            $path = APPPATH . "controllers/" . $route[0] . ".php";
            if(realpath($path)){
                require $path;
                $controller = new $controller;

                if($method != 'index'){
                    $variables = array();
                    $i = 0;
                    foreach($route as $vars){
                        if ($i &gt;= 2)
                            $variables[] = $route[$i];
                        $i++;
                    }

                    call_user_func_array(array($controller, $method), $variables);
                }else{
                    $controller-&gt;index();
                }
            }
        }else{
            $controller = $config['deafult_controller'];
            require APPPATH . "controllers/" . $controller . ".php";
            $controller = ucfirst($controller);
            $controller = new $controller;
            $method = 'index';
            $controller-&gt;$method();
        }
    }
}


The second thing I want help with is the load class. Is there a better way to load models into the controller? Loading library files was quite difficult; you have to load it in each file. If you load the library in the controller, you'll have to load it again in the model if you want to access it. What's the best way to do this?



class Load{
    function __construct($controller){
        $this-&gt;controller = $controller;
    }

    // loads a specified model
    public function model($model){
        $model = strtolower($model);
        if(file_exists(APPPATH . "models/$model.php")){
            require(APPPATH . "models/$model.php");
            $modelclass = ucfirst($model . '_Model');
            // call function to include it in the controller
            $this-&gt;controller-&gt;$model = new $modelclass;
        }
    }

    // loads a veiw
    public function view($view, $data = NULL){
        // asign filepath
        $path = APPPATH . "views/" . $view . ".php";
        // asign variables if $data is set
        if($data != NULL)
            foreach($data as $var =&gt; $value)
                $$var = $value;

        if(file_exists($path)){
            ob_start();
            require($path);
            print(ob_get_clean());
        }else
            return false;
    }

    public function library($library){
        $library = strtolower($library);
        if(file_exists(LIBRARY . "$library.php")){
            require(LIBRARY . "$library.php");
            $libraryclass = ucfirst($library);

            $this-&gt;controller-&gt;$library = new $libraryclass;
        }
    }
}


And finally, how secure is the entire thing. What security flaws can you see? Are there any major points I should improve upon.
Nice initiative on a lightweight MVC framework!

Note wanted to add more reference links, but it won't allow me to do more thanb 2

Config


Pass the default controller setting to the function 


or 


Pass all routing related settings to the __constructor. and use them as class attributes


Loader class

The setup isn't all that bad. Nice and lightweight. A few things, i would do different;


Seperations of conserns (One of the SOLID principles). Let the loader just load an return the instances.

Don't bind the loaded elements directly to controller in you class, so in future you could also use it for different cases then just the controller class.
Don't render the views in a loader. Make a render class or such. If you way of rendering changes, you would have to change the loader. Which ultimately don't make sense.

Make APP_PATH and LIBRARY settable within the loader, and call them differently


A loader class attribute for each load path 
Default the attributes to APP_PATH and LIBRARY
Getter and Setter for load paths
Now you would be able to integrate different paths / modules etc. Making it more flexible

Autoloader for library classes


By registering the loader as php autoloader you can just instantiate a class. 
If not yet loaded into mem, it will be sent to the autoloader. 
There you resolve the path it should be on and instantiate.



Security

The big thing in this form of autoloading is the concern for input. Make sure all input is either given by the application itself or validate it.


Validate user strings that will be autoloaded (eg. controller names)
You can do this by first doing a realpath() check on the computed path. And make sure the realpath() is within the locations you would expect.
This prevenst users from entering stuff like '......\uploads\mayhackscript' which would be executed otherwise.


This is a real danger.

General remarks

Take a look at te following;


SOLID principles
PSR-2 coding standards; note, it extends PSR-1 which extends PSR-0


Good luck on your project!