1
\$\begingroup\$

I need some suggestions on how to approach this. I want to allow users to create sections of website. The code so far is working but since I am new to back-end I feel like there is better, more elegant way to approach this. I am open to any approaches, as long as the code is kept as concise as possible.

  1. The user clicks "add section" button (there would be different types of sections to choose from), the html of each section will be stored in an external file
  2. The id of the section should be inserted into the database (alongside some other details such as user uniqid)
  3. The section should be inserted inside a div

At the moment this is how I have approached it:

if (isset($_POST["add_section"])) {
    $section_id = $_POST["add_section"];
    $stmt = $conn->prepare('INSERT INTO sections (user_id, section_id) VALUES (?, ?)');
    $stmt->bind_param('ss', $row['user_id'], $section_id);
    $stmt->execute();
}

The value of the button is the id of the section passed to the database.

<form method="post">
    <button class="button_1" value="navigation_ht" name="add_section>Seleccionar</button>
</form>

I want to allow the user to be able to include up to 3 sections.

$sql = "SELECT * FROM sections WHERE user_id = '{$row['user_id']}'";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    while($row = $result->fetch_assoc()) {
        include('shared/'.$row['section_id'].'.php');
    }
}

I was considering to do the following, but if the section is not created, there is error message:

$sql = "SELECT * FROM sections WHERE user_id = '{$row['user_id']}'";
$result = $conn->query($sql);
while($row = $result->fetch_assoc()) {
    include('shared/'.$row['section_id'].'.php');
    include('shared/'.$row['section_id'].'.php');
    include('shared/'.$row['section_id'].'.php');
}
\$\endgroup\$
  • \$\begingroup\$ This code is far from complete. I my opinion it cannot be reviewed in this state. \$\endgroup\$ – KIKO Software Jul 22 at 17:21
0
\$\begingroup\$

This looks very clean, there is not much to improve upon.

However, there is a glaring security issue: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Your code should not allow malicious JavaScript to be stored inside of the db.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.