I'm an experienced developer myself but for a current project I am working on I have decided to hire some developers to develop a mobile app which requires some supporting web services (developed in PHP).
I know myself that the code I have pasted below is worse than what I would expect a 5 year old to produce after spending 5 minutes reading Dummy's Guide to Programming PHP Badly. However, this is meant to be a professional software development company!
After a quick perusal I can see that it is wide open to basic SQL injection attacks, conforms to no web services standard I know of, barely uses any sound principles of software design or architecture and quite frankly I think it must be some kind of practical joke.
I was wondering if anyone else could help me out by pointing out the problems in this code and/or just generally tearing it apart and having a good laugh at it.
I might then show this page to our developers in the hope that they can take on some of this feedback and hopefully end up producing some code that I would dare to put into a production environment.
Note: The code I have pasted below is not doctored. It includes all the useful comments and descriptions that the developers have kindly left for us to make it easy to maintain.
This is the 'Front Controller':
<?php
include "includes/dbconnect.php";
include "user_class.php";
$userval = new userinfo();
switch($_POST['action'])
{
//****** User profile Class *******//
case "login":
$user=$userval->emailsign($_POST);
break;
case "emailsignstp2":
$user=$userval->emailsignstp2($_POST);
break;
case "usersignIN":
$user=$userval->usersignIN($_POST);
break;
/*case "register":
$user=$userval->user_registration($_REQUEST, $_FILES);
break;
case "logout":
$user=$userval->logout($_REQUEST);
break;*/
}
echo json_encode($user);
//print_r($user);
?>
And the API class itself:
<?php
ini_set("display_errors", 1);
if($_SERVER['HTTP_HOST'] == "localhost/whatittext/") {
//define('DOMAIN', "http://localhost/nglcc/profile_img/");
} else {
define('DOMAIN', "http://myapi.com/");
}
class userinfo
{
function emailsign($email)
{
$whatittext['emaillogin'] = array();
$uemail = $email['uemail'];
if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Inalid email";
}else{
$sql=mysql_query("select count(*) AS `cct`, t1.* from `users` AS t1 where t1.`uemail`='".$uemail."' AND t1.`status`= '1'") or die(mysql_error());
$row = mysql_fetch_array($sql);
if($row['cct'] > 0)
{
$whatittex["emaillogin"]["result"]="true";
$whatittex["emaillogin"]["uname"]=$row['uname'];
$whatittex["emaillogin"]["uemail"]=$row['uemail'];
$whatittex["emaillogin"]["create_dt"]=$row['create_dt'];
$whatittex["emaillogin"]["ucountry"]=$row['ucountry'];
}
else
{
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Email address dose not exist.";
}
}
return $whatittex["emaillogin"];
}
function emailsignstp2($emailpass)
{
$whatittext['emaillogin'] = array();
$uemail = $emailpass['uemail'];
$upass = $emailpass['upass'];
if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Inalid Email";
}else{
$sql=mysql_query("select count(*) AS `cct`, t1.* from `users` AS t1 where t1.`uemail`='".$uemail."' AND t1.`upassword`='".$upass."' AND t1.`status`= '1'") or die(mysql_error());
$row = mysql_fetch_array($sql);
if($row['cct'] > 0)
{
$whatittex["emaillogin"]["result"]="true";
$whatittex["emaillogin"]["uname"]=$row['uname'];
$whatittex["emaillogin"]["uemail"]=$row['uemail'];
$whatittex["emaillogin"]["create_dt"]=$row['create_dt'];
$whatittex["emaillogin"]["ucountry"]=$row['ucountry'];
}
else
{
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Invalid email or password.";
}
}
return $whatittex["emaillogin"];
}
function usersignIN($signin)
{
$whatittext['emaillogin'] = array();
$uemail = $signin['uemail'];
$upass = $signin['upass'];
$uname = $signin['uname'];
$ucountry = $signin['ucountry'];
if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Inalid email";
}else{
$sql=mysql_query("select count(*) AS `cct` from `users` where `uemail`='".$uemail."'") or die(mysql_error());
$row = mysql_fetch_array($sql);
if($row['cct'] > 0)
{
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Email address already exist.";
}
else
{
if($uemail=='' || $upass=='' || $uname=='' || $ucountry=='')
{
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="Please fill all of the following option properly.";
}
else
{
$sql2=mysql_query("select count(*) AS `cct2` from `users` where `uname`='".$uname."'") or die(mysql_error());
$row2 = mysql_fetch_array($sql2);
if($row2['cct2'] > 0)
{
$whatittex["emaillogin"]["result"]="false";
$whatittex["emaillogin"]["error"]="User name already exist.";
}
else
{
$sql=mysql_query("insert into `users` set `uemail`='".$uemail."', `uname`='".$uname."', `upassword`='".$upass."', `ucountry`='".$ucountry."'");
$whatittex["emaillogin"]["result"]="true";
$whatittex["emaillogin"]["uname"]=$uname;
$whatittex["emaillogin"]["uemail"]=$uemail;
$whatittex["emaillogin"]["ucountry"]=$ucountry;
}
}
}
}
return $whatittex["emaillogin"];
}
/*function user_login($arr) //LOGIN//
{
$login["whatittext"] = array();
$email=$arr['email'];
$password=$arr['pass'];
if (!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email))
{
$login["nglcc"]["result"]="false";
$login["nglcc"]["error"]="Inalid Email";
}
else if(trim($password)!="")
{
$sql=mysql_query("select * from `user` where `email`='".$email."' AND password='".$password."' AND `status`= '1'");
$rows=@mysql_num_rows($sql);
if($rows == 1)
{
$row = mysql_fetch_assoc($sql);
$r[0] = $row;
mysql_query("update `user` set `login_status`='1' where uid=".$row['uid']);
$login["nglcc"]["result"]="true";
$login["nglcc"]["login_info"] = $r;
}
else
{
$login["nglcc"]["result"]="false";
$login["nglcc"]["error"] = "Invalid email/password";
}
}
else
{
$login["nglcc"]["result"]="false";
$login["nglcc"]["error"]="Email/password should not blank";
}
return $login;
}*/
}
?>
