I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can...
The way I am trying to design this CMS is to keep including 'modules' within a page to minimize code. I am using extensively POST and GET variables to decide which module will be reached. The Index page will be the main page from which modules will be included and accessible.
My questions:
- Will this design be handy when code get more and more complicated? More POST requests etc.
- I could there be any security vulnerabilities?
- Any performance issues? (None noticed)
- Do I utilize code properly as this is my real PHP project?
- I would love some intensive criticism about this code.
Config File:
<?php
class cms {
private $dbhost = "";
private $dbuser = "";
private $dbpass = "";
private $dbdb = "";
private $dbc;
public $website;
public $user;
public $theme;
function __construct() {
$this->session();
$this->getWebsite();
}
function connect() {
$dbc = mysqli_connect($this->dbhost, $this->dbuser, $this->dbpass, $this->dbdb) or die("Error " . mysqli_error($dbc));
return $dbc;
}
function session() {
if(!isset($_SESSION)) {
session_start();
}
}
function getWebsite() {
$dbc = $this->connect();
$stmt = $dbc->prepare("SELECT * FROM website");
$stmt->execute();
$result = $stmt->get_result();
$this->website = $result->fetch_assoc();
$stmt->close();
$this->theme = $this->website['theme'];
}
}
?>
Index.php File:
<?php
require_once('config/config.inc.php');
$cms = new cms();
include("template/" . $cms->theme . "/head.php");
$moduleArray = array_diff(scandir('module/', 1), array('..', '.', 'admin'));
if(($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'POST') && !empty($_GET['page'])) {
$p = $_GET['page'];
$ext = ".inc.php";
if (get_magic_quotes_gpc()) {
$p = stripslashes($p);
}
if(in_array($p . $ext, $moduleArray)) {
include("module/" . $p . $ext);
}
else {
header('Location: /');
}
} // end (GET || POST) && GET
else {
foreach($moduleArray as $module) {
$name = substr($module, 0, -8);
echo " <a href=\"index.php?page=$name\"> $name </a><br />";
}
} // end ELSE
include("template/" . $cms->theme . "/foot.php");
?>
Demo Module: Page.inc.php
<?php
$dbc = $cms->connect();
if(isset($_GET['page'])) {
if(isset($_GET['title'])) {
$t = $_GET['title'];
if (get_magic_quotes_gpc()) {
$t = stripslashes($username);
}
if ($stmt = $dbc->prepare("SELECT title, content_main FROM pages WHERE url=?")) {
$stmt->bind_param('s', $t);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($title, $content_main);
if($stmt->fetch()) {
echo "<h2>$title</h2><p>$content_main</p>";
}
else {
echo "<h2>404</h2><p>The page doesn't exist!</p>";
}
$stmt->free_result();
$stmt->close();
}
else {
echo "error";
}
}
else {
if ($stmt = $dbc->prepare("SELECT title, url FROM pages")) {
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($title, $url);
while ($stmt->fetch()) {
echo "<a href=\"index.php?page=page&title=$url\">$title</a></br />";
}
$stmt->free_result();
$stmt->close();
}
}
}
else {
header('Location: ../');
}
?>
