Background

I created a gaming community website about 13 years ago. It uses PHP, SQL, HTML, and CSS. It does not use a framework or template engine. It includes features such as a login system for members, different levels of access depending on your rank, dropping members that are inactive from the member list, and other features useful to a gaming community. At its height, the gaming community that this website supported had 300 active members, so this code has been in production for a while. This website's PHP code has about 97 versions.

Questions

1. Do I need to learn a framework like Laravel and convert everything to that? The learning curve for frameworks looks steep. Is it worth it? What kinds of features do they provide?

2. Do I need to start using classes and OOP? What are the benefits? Where would I start? As you can see, all of my code from this sample page is non-OOP.

3. Feel free to give any feedback you'd like on the code I've included.

4. I am already aware of a couple of things that I should upgrade. For example, I need to convert from MYSQL to PDO for security, a template engine like Smarty is better for code readability, I should sanitize my incoming $_POST data, I should use an ENUM for access levels instead of numbers, etc. There's a lot that needs to be upgraded.

Sample Code

Edit: Security

My website's lack of security has been mentioned in several posts. I do have some security, since this is production code. I just didn't post the gigantic function and navigation files that get loaded before the code for this specific page. Here is some of the security code.

SQL Injection Defense Code

XSS Defense Code

Expiring Cookies

IP Ban For Too Many Login Attempts

I created a gaming community website about 13 years ago. It uses PHP, SQL, HTML, and CSS, and does not use a framework or template engine. It includes features such as a login system for members, different levels of access depending on your rank, dropping members that are inactive from the member list, and other features useful to a gaming community. At its height, the gaming community that this website supported had 300 active members, so this code has been in production for a while. This website's PHP code has about 97 versions.

##Questions

1. Do I need to learn a framework like Laravel and convert everything to that? The learning curve for frameworks looks steep. Is it worth it? What kinds of features do they provide?

2. Do I need to start using classes and OOP? What are the benefits? Where would I start? As you can see, all of my code from this sample page is non-OOP.

3. I am already aware of a couple of things that I should upgrade. For example, I need to convert from MYSQL to PDO for security, a template engine like Smarty is better for code readability, I should sanitize my incoming $_POST data, I should use an ENUM for access levels instead of numbers, etc. There's a lot that needs to be upgraded.

##Sample code

##Security

My website's lack of security has been mentioned in several posts. I do have some security, since this is production code. I just didn't post the gigantic function and navigation files that get loaded before the code for this specific page.

SQL injection defense code

XSS defense code

Expiring cookies

IP ban for too many login attempts

I have not added support for IPv6. If somebody connects to my website using an IPv6, it may throw some kind of error when my code tries to add the overly large IPv6 IP to the IP log. I haven't tested it yet.

Cookies expire after 30 days.

Cookies (and therefore user logins) expire after 30 days.

Sessions

I chose to not use sessions. The cookies handle everything related to user logins.

More than 10 failed login attempts results in a 1 day IP ban from the entire site. The IP ban looks at the first 3 digits of the IP address, which helps to block some types of dynamic IP where the 4th digit will change but the rest of the digits will stay the same. This is a less effective technique now, with the prevalence of static IP's at home, less AOL users (often dynamic IP following the aforementioned pattern), and mobile phones with constantly changing 3G/4G IP's, but it was a decent idea back in the day.