I am creating a social network and I want to know how secure and clean this code is. I had to update it to prepared statements because I was following a tutorial and even though it was made in 2019 it was using 15 year old code. So can someone tell me if it's good or needs improvement ? Thanks.
<?php
include("includes/header.php");
//calls class. You can specify parameters when you define your function to accept input values at run time
$message_obj = new Message($con, $userLoggedIn);
if(isset($_GET['u']))
$user_to = $_GET['u'];
else {
// calls function inside of class
$user_to = $message_obj->getMostRecentUser();
if($user_to == false)
$user_to = 'new';
}
if($user_to != "new")
$user_to_obj = new User($con, $user_to);
if(isset($_POST['post_message'])) {
if(isset($_POST['message_body'])) {
$body = mysqli_real_escape_string($con, $_POST['message_body']);
$date = date("Y=m-d H:i:s");
$message_obj->sendMessage($user_to, $body, $date);
}
}
$user_data_query = $con->prepare('SELECT first_name, last_name, num_likes FROM users WHERE username = ?');
$user_data_query->bind_param("s", $userLoggedIn);
$user_data_query->execute();
$user_data_query_result = $user_data_query->get_result();
while ($row = $user_data_query_result->fetch_assoc()) {
$first_name = $row['first_name'];
$last_name = $row['last_name'];
$num_likes = $row['num_likes'];
}
$user_data_query_result->close();
$stmt = $con->prepare("SELECT profile_pic FROM users WHERE username = ? ");
$stmt->bind_param("s", $userLoggedIn);
$stmt->execute();
$stmt->bind_result($img);
$stmt->fetch();
$stmt->close();
?>
<style type="text/css">
.convos_column {
background-color: #fff;
padding: 10px;
border: 1px solid #f2f2f2;
border-radius: 7px;
box-shadow: 2px 2px 1px #f2f2f2;
z-index: -1;
word-wrap: normal;
}
#convos {
background-color: #fff;
padding: 10px;
border: 1px solid #f2f2f2;
border-radius: 7px;
box-shadow: 2px 2px 1px #f2f2f2;
z-index: -1;
word-wrap: normal;
width: 30%;
height: 400px;
overflow: scroll;
float: left;
left: -16%;
top: 350px;
position: relative;
}
#convos img {
width: 50px;
height: 50px;
}
#convos p {
top: 10px;
}
.user_detailss {
width: 20%;
height: 310px;
float: right;
position: relative;
right: 95%;
top: 4%;
}
</style>
<head>
<link rel="shortcut icon" type="image/png" href="favicon.ico"/>
</head>
<div class="user_detailss column">
<a href="<?php echo $userLoggedIn; ?>">
<img src="<?php echo $img; ?>" style="border-radius: 5px;" width="130px" height="130px">
</a>
<br><br>
<div class="user_details_left_right">
<a href="<?php echo $userLoggedIn; ?>">
<?php
echo $first_name . " " . $last_name;
?>
</a>
<br>
<br>
<?php echo "Likes: " . $num_likes; ?>
</div>
</div>
<div class="main_column column" id="main_column">
<?php
if($user_to != "new") {
echo "<h4>You and <a href='$user_to'>" . $user_to_obj->getFirstAndLastName() . "</a></h4><hr><br>";
echo "<div class='loaded_messages' id='scroll_messages'>";
echo $message_obj->getMessages($user_to);
echo "</div>";
}
else {
echo "<h4>New Message</h4>";
}
?>
<div class="message_post">
<form action="" method="POST">
<?php
if($user_to == "new") {
echo"Select the friend you would like to message <br><br>";
?>
To: <input type='text' onkeyup='getUsers(this.value, "<?php echo $userLoggedIn; ?>")' name='q' placeholder='Name' style='padding-left: 5px;' autocomplete='off' id='search_text_input'>
<?php
echo "<div class='results'></div>";
} else {
echo "<textarea placeholder='Enter your message...' name='message_body' id='message_textarea'></textarea>";
echo "<input type='submit' name='post_message' class='info' id='message_submit' value='Send Message'>";
}
?>
</form>
<br><br><br>
</div>
<script type="text/javascript">
var div = document.getElementById("scroll_messages");
if(div != null) {
div.scrollTop = div.scrollHeight;
}
</script>
</div>
<div class="user_convos convos_column" id="convos">
<h4>Conversations</h4>
<br>
<div class='loaded_conversations'>
<?php echo $message_obj->getConvos(); ?>
</div>
<a href="messages.php?u=new">New Message</a>
<br><br>
</div>
