2
\$\begingroup\$

I'm an experienced developer myself but for a current project I am working on I have decided to hire some developers to develop a mobile app which requires some supporting web services (developed in PHP).

I know myself that the code I have pasted below is worse than what I would expect a 5 year old to produce after spending 5 minutes reading Dummy's Guide to Programming PHP Badly. However, this is meant to be a professional software development company!

After a quick perusal I can see that it is wide open to basic SQL injection attacks, conforms to no web services standard I know of, barely uses any sound principles of software design or architecture and quite frankly I think it must be some kind of practical joke.

I was wondering if anyone else could help me out by pointing out the problems in this code and/or just generally tearing it apart and having a good laugh at it.

I might then show this page to our developers in the hope that they can take on some of this feedback and hopefully end up producing some code that I would dare to put into a production environment.

Note: The code I have pasted below is not doctored. It includes all the useful comments and descriptions that the developers have kindly left for us to make it easy to maintain.

This is the 'Front Controller':

<?php
include "includes/dbconnect.php";
include "user_class.php";

$userval = new userinfo();

switch($_POST['action'])
{   
    //****** User profile Class *******//
case "login":
    $user=$userval->emailsign($_POST);
break;
case "emailsignstp2":
    $user=$userval->emailsignstp2($_POST);
break;
case "usersignIN":
    $user=$userval->usersignIN($_POST);
break;
/*case "register":
    $user=$userval->user_registration($_REQUEST, $_FILES);
break;
case "logout":
    $user=$userval->logout($_REQUEST);
break;*/
}
echo json_encode($user);
//print_r($user);
?>

And the API class itself:

<?php
ini_set("display_errors", 1);
if($_SERVER['HTTP_HOST'] == "localhost/whatittext/") {
//define('DOMAIN', "http://localhost/nglcc/profile_img/");
} else {
define('DOMAIN', "http://myapi.com/");
}

class userinfo 
{   
    function emailsign($email)
{
    $whatittext['emaillogin'] = array();
        $uemail = $email['uemail'];

    if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {
            $whatittex["emaillogin"]["result"]="false";
            $whatittex["emaillogin"]["error"]="Inalid email";

        }else{

        $sql=mysql_query("select count(*) AS `cct`, t1.*  from `users` AS t1 where t1.`uemail`='".$uemail."' AND t1.`status`= '1'") or die(mysql_error());

        $row = mysql_fetch_array($sql);

        if($row['cct'] > 0)

        {

            $whatittex["emaillogin"]["result"]="true";

            $whatittex["emaillogin"]["uname"]=$row['uname'];

            $whatittex["emaillogin"]["uemail"]=$row['uemail'];

            $whatittex["emaillogin"]["create_dt"]=$row['create_dt'];

            $whatittex["emaillogin"]["ucountry"]=$row['ucountry'];

        }

        else

        {

            $whatittex["emaillogin"]["result"]="false";

            $whatittex["emaillogin"]["error"]="Email address dose not exist.";

        }

    }

    return $whatittex["emaillogin"];

}

function emailsignstp2($emailpass)

{

    $whatittext['emaillogin'] = array();

    $uemail = $emailpass['uemail'];

    $upass = $emailpass['upass'];

        if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {

            $whatittex["emaillogin"]["result"]="false";

            $whatittex["emaillogin"]["error"]="Inalid Email";



    }else{

        $sql=mysql_query("select count(*) AS `cct`, t1.*  from `users` AS t1 where t1.`uemail`='".$uemail."' AND t1.`upassword`='".$upass."' AND t1.`status`= '1'") or die(mysql_error());

        $row = mysql_fetch_array($sql);

        if($row['cct'] > 0)

        {

            $whatittex["emaillogin"]["result"]="true";

            $whatittex["emaillogin"]["uname"]=$row['uname'];

            $whatittex["emaillogin"]["uemail"]=$row['uemail'];

            $whatittex["emaillogin"]["create_dt"]=$row['create_dt'];

            $whatittex["emaillogin"]["ucountry"]=$row['ucountry'];

        }

        else

        {

            $whatittex["emaillogin"]["result"]="false";

            $whatittex["emaillogin"]["error"]="Invalid email or password.";

        }

    }

    return $whatittex["emaillogin"];

}



function usersignIN($signin)

{

    $whatittext['emaillogin'] = array();

    $uemail = $signin['uemail'];

    $upass = $signin['upass'];

    $uname = $signin['uname'];

    $ucountry = $signin['ucountry'];



        if (!preg_match("/^[^@]{1,64}@[^@]{1,255}$/", $uemail)) {

            $whatittex["emaillogin"]["result"]="false";

            $whatittex["emaillogin"]["error"]="Inalid email";



        }else{

            $sql=mysql_query("select count(*) AS `cct`  from `users` where `uemail`='".$uemail."'") or die(mysql_error());

            $row = mysql_fetch_array($sql);

            if($row['cct'] > 0)

            {   

                $whatittex["emaillogin"]["result"]="false";

                $whatittex["emaillogin"]["error"]="Email address already exist.";

            }

            else

            {   

                    if($uemail=='' || $upass=='' || $uname=='' || $ucountry=='')

                    {

                        $whatittex["emaillogin"]["result"]="false";

                        $whatittex["emaillogin"]["error"]="Please fill all of the following option properly.";

                    }

                    else

                        {

                            $sql2=mysql_query("select count(*) AS `cct2`  from `users` where `uname`='".$uname."'") or die(mysql_error());

                            $row2 = mysql_fetch_array($sql2);

                            if($row2['cct2'] > 0)

                            {   

                                $whatittex["emaillogin"]["result"]="false";

                                $whatittex["emaillogin"]["error"]="User name already exist.";

                            }

                            else

                            {

                            $sql=mysql_query("insert into `users` set `uemail`='".$uemail."', `uname`='".$uname."', `upassword`='".$upass."', `ucountry`='".$ucountry."'");

                            $whatittex["emaillogin"]["result"]="true";

                            $whatittex["emaillogin"]["uname"]=$uname;

                            $whatittex["emaillogin"]["uemail"]=$uemail;

                            $whatittex["emaillogin"]["ucountry"]=$ucountry;

                            }

                        }

            }

    }

    return $whatittex["emaillogin"];

}

/*function user_login($arr) //LOGIN//

{   

    $login["whatittext"] = array();

    $email=$arr['email'];

    $password=$arr['pass'];

    if (!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email))

    {

    $login["nglcc"]["result"]="false";

    $login["nglcc"]["error"]="Inalid Email";

    }

    else if(trim($password)!="")

        {

        $sql=mysql_query("select * from `user` where `email`='".$email."' AND password='".$password."' AND `status`= '1'");

        $rows=@mysql_num_rows($sql);

            if($rows == 1)

            {

            $row = mysql_fetch_assoc($sql);

            $r[0] = $row;

            mysql_query("update `user` set `login_status`='1' where uid=".$row['uid']);

            $login["nglcc"]["result"]="true";

            $login["nglcc"]["login_info"] = $r;

            }

            else

            {

            $login["nglcc"]["result"]="false";

            $login["nglcc"]["error"] = "Invalid email/password";



            }

        }

    else

        {

        $login["nglcc"]["result"]="false";

        $login["nglcc"]["error"]="Email/password should not blank";

        }

    return $login;

}*/
}
?>
\$\endgroup\$
  • \$\begingroup\$ If this is the server code, I don't want to see the mobile code. I bet 5/2 that they misuse ssl in at least one way \$\endgroup\$ – miniBill Feb 15 '14 at 9:21
5
\$\begingroup\$

In order of badness.

  1. SQL injection (as you pointed out).
  2. Plaintext passwords, hold the salt. Obviosuly no investigation was done on how to deal with passwords.
  3. mysql_* is softly deprecated now deprecated.
  4. Horrible double line-spacing (Choose every second line and start again. I'd choose the blanks.)
  5. Item by item setting of an array. Build the whole thing in a single statement.
  6. Lowercase is not a valid choice for naming methods and variables (e.g $whatitext, ->emailsignstp2), use pascal or camel case.
  7. Horrible variable name $whatitex (probably mispelt) also $whatitext.
  8. The User class is completely pointless, it is a group of functions. Fake OO sucks. Seriously, just use a namespace and normal functions.
  9. Validation of the email is woeful. See: filter_var
  10. No useful comments.
  11. Pointless abbreviation of method emailsignstp2.
  12. Randomly commented code shouldn't exist when using a revision control system.

I'm sure I have missed a few things. This was unprofessional work. They will need to learn very quickly. I wouldn't want them doing any serious work (especially if they were trying to write it with classes in an OO style).

\$\endgroup\$
  • \$\begingroup\$ Item by item setting of an array, double line-spacing, pointless classes and randomly commented code are sound signatures of "by lines of code" payment agreement.... Naive attempts to get rich quick. Next try are things like if(true){ some verifiable code} else {coder's net profit} \$\endgroup\$ – Michael Apr 19 '12 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.