I am a newbie and have been following a tutorial I bought on Udemy. But I was told it is old and teaches bad code practices. I used this in some code from my old projects. Now I'd like to know how secure it is.
Posts Upload:
<?php
error_reporting(-1);
require 'config/connect.php';
require 'auth_login.php';
require 'includes/header.php';
// just define at the top of the script index.php
$username = '';
$username = isset($_SESSION['username']) ? $_SESSION['username'] : '';
//Initializing variable
$body = ""; //Initialization value; Examples
//"" When you want to append stuff later
//0 When you want to add numbers later
//isset()
$body = isset($_POST['body']) ? $_POST['body'] : '';
//empty()
$body = !empty($_POST['body']) ? $_POST['body'] : '';
if(isset($_POST['bts'])) {
if (empty($_POST["body"])) {
echo"You didn't enter anything . <a href= profile.php>Try again</a>";
} else {
$body = $_POST["body"];
$sql = "INSERT INTO posts (username, body ) VALUES ('" . $username . "', '" . $body . "')";
if(mysqli_query($conn, $sql)){
header('Location: profile.php');
die();
} else{
echo "<br>error posting . <br> <a href= profile.php>Try again</a> " .
mysqli_error($conn);
}
}
}
?>
Profile pic upload and fetch:
<?php
$username = trim( isset($_SESSION['username']) ? $_SESSION['username'] : "" );
$userPic = isset($_SESSION['userPic']) ? $_SESSION['userPic'] : "";
$info = date('Y-m-d_H-i-s');
if(!empty($username)) {
if (isset($_FILES['fileToUpload'])) {
$errors= array();
$file_name = $_FILES['fileToUpload']['name'];
$file_size = $_FILES['fileToUpload']['size'];
$width = 1500;
$height = 1500;
$file_tmp = $_FILES['fileToUpload']['tmp_name'];
$file_type = $_FILES['fileToUpload']['type'];
$tmp = explode('.',$_FILES['fileToUpload']['name']);
$file_ext=strtolower (end ($tmp));
$extensions= array("jpeg","jpg","png");
if(in_array($file_ext,$extensions)=== false){
$errors[]="extension not allowed, please choose a JPEG or PNG file.";
}
if ($file_size > 8097152) {
$errors[] = 'File size must be 2 MB';
}
if ($width > 1500 || $height > 1500) {
echo"File is to large";
}
if(empty($errors)==true) {
$userPic = date('Y-m-d_H-i-s').$file_name;
move_uploaded_file($file_tmp,"uploads/".$userPic);
$stmt = $conn->prepare("UPDATE users SET userPic=?, date_time=? WHERE username = ?");
$date_time = date("Y-m-d H:i:s");
$stmt->bind_param('sss', $userPic, $date_time, $username);
/* execute prepared statement */
$stmt->execute();
printf("", $conn->affected_rows);
/* close statement and connection */
}
}
}
else {
echo "Invalid Username";
}
?>
<?php
$getimg = mysqli_query($conn,"SELECT userPic, date_time FROM users WHERE
username='".mysqli_real_escape_string( $conn, $username )."'");
$rows=mysqli_fetch_array($getimg);
$img = $rows['userPic'];
?>
Posts fetch:
<?php
$username = isset($_SESSION['username']) ? $_SESSION['username'] : '';
$username = trim(isset($_GET['username']) ? $_GET['username'] : $username);
//Write the query
$sql = "SELECT * FROM posts WHERE username = '" . $username. "' ORDER BY post_id DESC ";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {
echo '<div id="rcorners2">';
echo '<p id="p2">' .$row['username']. '</p>';
echo '<p id="p4">' .$row['date_time']. '</p>';
echo '<hr id="hr2">';
echo '<p id="p3">' .$row['body']. '</p>';
echo '<div class="test"> <a href="#" class="fill-div"></a></div>';
echo'</div>';
echo'</br>';
}
}
else {
echo '<center><b><p style="font-size: 30px; color: #262626;"> Write your first post</p></b></center>';
}
?>
