4
This code is safe from the SQL injection standpoint but it is likely prone to XSS because of the untreated output, and also to possibly leak the sensitive information due to the error message unconditionally spat out.
Regarding other improvements I would suggest a more robust connection code and to avoid bindParam calls thanks to disabled emulation mode.
...
4
The fact that mysqli has nothing to do with PDO aside, there are several things about your code at whole:
this "class Database" from some article is a dummy. It is absolutely useless and there is not a single reason to prefer it over original PDO. Let alone some flaws in the code inside.
under no circumstances you should create a new database connection in ...
3
If you allow users to pass in arguments that are column names (for example array keys that you turn into column names). Then the keys could be modified to allow SQL Injection. It's not clear in the question if you plan to do this. If you just want to have dynamic arguments (with known columns) then preparing the query should suffice as all the user data ...
2
For improved readability and for reduced processing & memory, I recommend an early return and no single-use variables.
public function getAllBill($user_rank, $user_id) {
if (!in_array($user_rank, ['member', 'moderator'])) {
return [];
}
$parameters = [];
$sql = 'SELECT *
FROM invoice_user
INNER JOIN ...
2
Everything must be done on the database level.
It is incomparably resource-friendly. Instead of fetching all the data from database and looping over many rows most of which do not even meet the condition, we must set this condition right in the query, to fetch the only rows we need.
Better yet, instead of deleting and updating rows one by one, we must ...
1
After a cursory read, this jumped out at me:
$user_check_query -> bind_param("ss", $email);
You’re binding 1 string parameter, but have two s codes.
You do it again here:
$stmt->bind_param("sssssssssssssss",
$firstname,$lastname,$email,
$email,$password1,$account_verified,$str);
15 s’s but only 7 parameters.
It appears you are ...
Only top voted, non community-wiki answers of a minimum length are eligible
