Hot answers tagged

8

Application Architecture The architecture of the application is divided into models and views to separate the data and business model from the user interface. Within the models there is an additional division, there are models that represent the database tables and there are models that represent a row of data within each database table. You missed ...


6

Problem Statement Tiered Architecture This database is the first part of the project, I couldn’t really create a friendly user interface until the database is working. Due to feature creep this database can now handle other kinds of books besides science fiction and fantasy. The most important step when taking on a project as you have, is deciding ...


6

No, don't do that. You seem to be filtering and escaping values out of paranoia rather than understanding what exactly would lead to a vulnerability. As a result, you are corrupting your data. A well designed application should use the database to store the value that the user typed into the textarea, not some mangled representation of it. If you mangle the ...


6

It would be better to use GROUP by in your SQL. By this way you will get rid of long SQL query. SELECT Rating, COUNT(id) FROM list WHERE songID=:songID GROUP BY Rating;


6

Please read about sql injection. Basically you should be using prepared statements with parameters for executing SQL queries - either PDO::prepare() or mysqli_prepare(). If that isn't enough of a clue, consider the case where $_POST['body'] contains something like body');DROP TABLE users; or some variant that leads to successful WHERE conditions that end up ...


5

You are missing charset in your DSN and you have emulated prepared statements still on. This could potentially leave your vulnerable to SQL injection. See Are PDO prepared statements sufficient to prevent SQL injection? As I have pointed out to you in an answer on Stack Overflow you should set the proper charset and disable emulated prepared statements. $...


5

Disclaimer: there will be a lot of links to my own site because I am helping people with PHP for 20+ years and got an obsession with writing articles about most common issues. I don't know much about restful stuff or whether it does matter, but there are many other areas of improvement. Let's review some of them The selectData() function First of all, ...


5

Funny coincidence, I just created the solution for your problem (but in PHP). The common thing here is the one-time use of a prepared statement, the difference is in the query string and arguments, so what you need is a function that accepts a query string, an argument determining what execution function to use (executeQuery() or executeUpdate()) and the ...


5

It looks like your script is part of a basic ajax searching technique. $_POST is typically used when writing to the database (or when there is a distinct reason that $_GET is unsuitable). Since you are merely SELECTing data, just use $_GET. if you are going to validate your incoming data, don't bother acquiring resources until after you have validated the ...


4

You must never store passwords as plain text in the database. Read an article about password hashing to avoid this mistake in the future. Make sure that you have a unique index on the username column. Otherwise it will be possible to create several users with the same username, and with equal or differing passwords.


4

By default you will have a numeric userId as well. Using the numeric userId rather than the username will probably perform better and reduce the size of the other tables. The userId will be a foreign key in 3 of the 4 tables and you need to consider the restraints that apply in each of the tables. Naming a picture in the user's profile pictureurl could be ...


3

Naming Try not to use generic names like $file. Make your code read easy for others. Say $files_to_backup for example. Check for errors when it matters If backup is important: check that the backups succeeded: if cp "${files[@]}"${war}/mediawiki_specific_backups";then rm -rf "${war}/${domain}" mkdir "${war}/${domain}" ... ... else #...


3

w3schools gets its placement from shelling out big bucks for high ranking in search engine results (as I've read), not for being the best resource for web development advice. When in doubt, read Stack Exchanges sites. SE sites enjoy the benefit of constant peer review. If something is not quite right, eventually a whistleblower is going to find it and ...


3

Error handling if response.status_code != 200: print('api response error: {}'.format(response)) return is better represented as a simple call to response.raise_for_status(). Also, this: try: response_payload = response.json() except ValueError: return is dangerous. Silently failing should (at the least) be left up to the caller to decide ...


3

w3fools following a W3 tutorial I would say the most important suggestion you can get is never ever use any tutorial from w3shcools. They are dubbed as "w3fools" for a reason. Their tutorials are outdated, buggy and - as you can already see from other answers - far from being optimal making you a monkey writing a lot of useless code that repeats ...


3

I don't know anything about mysql, so I'm ignoring that part of your question. For SQL Server, if you're trying to make an insert go faster you're going to want to: Do it in bulk Do it in parallel Make it minimally logged Do it in batches There are some things you can do that will handle all of this for you, which I list below, otherwise you'll have to ...


3

Array combine takes Keys + Values as values and combines them. Make sure they are the same size. $result = array_combine( array_column($array, 'level_id'), array_column($array, 'level') ); And also a nice trick with array_map() and NOT using a callback. $test1 = [ 'first-1', 'first-2', 'first-3', 'first-4', ]; $test2 = [ '...


3

I think there's three big things you might be able to do to improve the performance of this. Write your query such that it doesn't need to execute the subquery for each line and/or have a HAVING clause by using an inner join which will automatically exclude those with no match. Use ST_Distance_Sphere(POINT(:longitude, :latitude), POINT(cities.longitude, ...


3

The entire long conditional is definitely worth to be decomposed and consolidated. The main mechanics of optimization is based on 3 aspects: determining a common logic/behavior that needs to be unified. In your case such a common fragment is: $this->db->query($query . 'ORDER BY name'); $this->db->bind(':user_id', $user_id); return $this->db-...


3

String Operations You're copying a string and then starting to make various transformations to it. As std::isspace and std::tolower end up being called and can have quite complex logic, avoiding them (and using plain for/if) can bring a significant improvement to this part, especially if you are only interested in ASCII. Server-side VS client-side ...


3

I noticed you don't use the success function when the AJAX request succeeds, nor does your Favs.php give any feedback. It's there, but it's empty. Normally you first call the AJAX function, and only when it returns successfully you would give the appropriate feedback to the user. This means you could also give the user feedback when the AJAX request fails. ...


3

Type hints def create_signature(username, password): can be def create_signature(username: str, password: str) -> bytes: Quote style consistency Pick single or double: 'Authorization' : "Basic " Connection string security Please (please) do not store a password as a hard-coded source global: SERVER = 'localhost' USER = 'root' PASSWORD = '' ...


3

Users can pass whatever they wish into the u field of your form. Even the word new -- there is no defense against someone tricking your script and breaking the intended flow. You will either need to blacklist the u value new or alter your script to not rely on it (use a different flagging mechanism). When determining the value of $user_to, you can use ...


3

Ifs and nesting control loops Maybe this is just me but I would always enclose all if blocks within brackets {} to avoid ambiguity and possible logic errors: if($user_to != "new") $user_to_obj = new User($con, $user_to); if(isset($_POST['post_message'])) { if(isset($_POST['message_body'])) { $body = ...


2

Probably it's better to you concrete node version. Also, you can try expressjs framework. I have got simple example of Dockerfile here in this sub-directory of my repository. But that is without Docker Compose and connection to any database.


2

I first had to look up what KPI stands for. It is a "Key Performance Indicator". Then a "KPI breachable event" must be when some indicator gets over a certain threshold? That's my best guess... Better not use an abbreviation, or jargon, that is unrelated to programming, when explaining what your code is doing. There's a big change we don't know what you're ...


2

You should really try to use a more modern approach to closeable resources. The try-with-resources statement has been introduced in Java 7 (2011). This gets rid of all the hocus-pocus around closing and nested exceptions for you. Trivial rewrite of the first function: public static boolean checkLogin(String username, String password) { Connection ...


2

You got the SQL part quite well. If you only had been as careful when generating the HTML. At the very least, you should wrap every bit of output through htmlspecialchars. I'm sure there are better ways, but that's the basic building block, and you should learn it. function html_println($label, $value) { echo htmlspecialchars($label) . ": " . ...


2

I hate to break it to you, but no this is not very secure. While you are using some techniques to help secure it, there are still a few flaws with how you are managing the input and SQL checks. mySQL vs. mySQLi USE MYSQLI... you need the "i", mySQL is old and deprecated and should not be used if you are using a new enough version of PHP. 7+ Supports the ...


2

First of all, it's a good thing that you asked, only a few do care about handling errors. Unfortunately, the way you choose is frowned upon, in both cases. Luckily, I've got a couple articles that cover your question in every possible detail: a generalized one, PHP error reportig will show you the right approach for handling errors in general a direct ...


Only top voted, non community-wiki answers of a minimum length are eligible