Skip to main content
Share Your Experience: Take the 2024 Developer Survey
12 votes

Secured registration script

Correctness Also, all of the code works. No, it doesn't, so let's start with that. ...
Peter Taylor's user avatar
  • 24.1k
8 votes
Accepted

PHP MySQLi Connection File

First of all, there are many things in this code which you did right. Setting the proper error reporting mode is brilliant! And always setting the port explicitly is also a very good thing, saving you ...
Your Common Sense's user avatar
8 votes
Accepted

Return row count from mysqli prepared statement

You should definitely not be mixing procedural and object-oriented syntax. Although it works with un-mixed syntax, the process is working harder than it needs to and delivering more result set data ...
mickmackusa's user avatar
  • 8,674
7 votes

Inserting a record into MySQL with a timestamp

Security SQL Injection It's probably[*] secure, but it's not the right way to do it, see for example here why prepared statements are better than escaping. Sooner or later, you will mess up when ...
tim's user avatar
  • 25.1k
7 votes

Secured registration script

Your code is secure but hard to read, unclear and inconsistent. Poor Scarlett O'Hara will be saved in the database as ...
Your Common Sense's user avatar
7 votes
Accepted

PHP santization of textarea input

No, don't do that. You seem to be filtering and escaping values out of paranoia rather than understanding what exactly would lead to a vulnerability. As a result, you are corrupting your data. A well ...
200_success's user avatar
7 votes
Accepted

Query builder class pdo,sql

You have turned simple SQL prepared statements into this monstrosity that is extremely difficult to read and is open to SQL injection. Remove it! Don't go down this path. It is absolutely unnecessary. ...
Dharman's user avatar
  • 881
6 votes
Accepted

Adding an item to database + JSON

SQL Injection To expand a bit about what @Åna said: Yes, you are open to SQL injection. mysqli_query doesn't actually support multi-queries, so the described ...
tim's user avatar
  • 25.1k
6 votes

Adding an item to database + JSON

You have a major security vulnerability. As in, serious enough that if I knew your web address, I could delete your entire database. Near the top of your code, you set ...
Åna's user avatar
  • 429
6 votes

Security of post submission, picture upload and post fetch

Please read about sql injection. Basically you should be using prepared statements with parameters for executing SQL queries - either PDO::prepare() or ...
Sᴀᴍ Onᴇᴌᴀ's user avatar
6 votes

OOP: The correct use of classes and optimizing code

1. This is not OOP Ask yourself one simple question: what would happen if you remove words "class", "DBX" and "static" from your code? Nothing. Nothing would happen. It ...
Your Common Sense's user avatar
5 votes

User registration and authentication in PHP and PDO

Preamble Writing a secure user management and authentication system is not an easy task. It has many pitfalls and you should follow a lot of guidelines and best practices along the way. Security and ...
insertusernamehere's user avatar
5 votes
Accepted

Email subscription queries for a PHP website

If you are using the mysqli functions, then do not call mysql_real_escape_string(), which is part of the deprecated mysql suite of functions. At the least, you ...
200_success's user avatar
5 votes
Accepted

PHP MySQLi wrapper class

This is not much a wrapper. Rather call it a wannabe Query Builder. I don't know the reason, but many people are constantly trying to write something like this. And I don't understand why. Okay, for ...
Your Common Sense's user avatar
5 votes
Accepted

PHP - First Login System

Security You are escaping user input, which prevents SQL injection. It's good enough, but really not the recommended way to do this as it's too error-prone (whenever a project does this, it's ...
tim's user avatar
  • 25.1k
5 votes
Accepted

PHP login script

There is one logical inconsistency and two security issues. All other improvements will be just removal of useless or misplaced code. User not found case. If a user makes a typo in the username, ...
Your Common Sense's user avatar
5 votes
Accepted

php one-time prepared statement execution function

I tested your code and it does work, so far, so good. This type of code has been written many times, so by searching online you can find a lot of good examples. The main problem I have with your code ...
KIKO Software's user avatar
5 votes

php one-time prepared statement execution function

First of all, that's a very good idea to create such a function. It says you are a programmer in your heart. Sadly, but most PHP users never come to the idea of such an automation, writing thousands ...
Your Common Sense's user avatar
5 votes

Secure upload script

This is my personal opinion, but I'd say the following: The code should be formatted, I'd personally look at PSR-12 as this standard should be followed when possible. move_uploaded_file doesn't ...
Liam Sorsby's user avatar
5 votes
Accepted

Queries to get products selected in multiple stores

To elaborate on the Pslice's suggestion. Definitely, it must be just a single query with joins. Based on a slightly more sensible table structure, it could be like ...
Your Common Sense's user avatar
5 votes

Queries to get products selected in multiple stores

Table Name Is the table containing shop info really named shop_id, or was that a typo during creation of this post? If that is the actual name it seems ...
Sᴀᴍ Onᴇᴌᴀ's user avatar
5 votes
Accepted

A PHP class for the common database operations?

Yes of course it's OK to have such a file. However, your Connection class is hardly related to actual CRUD operations. It's more a DAO, a database abstraction object. Speaking of the code you provided,...
Your Common Sense's user avatar
4 votes

Programming MySQLi prepared statements

Let's sum up all the disparate suggestions from different answers. Globals are bad. Pass a connection variable as a function parameter. Such a staircase of conditional operators is a sign of bad ...
Your Common Sense's user avatar
4 votes

Programming MySQLi prepared statements

Let mysqli do the error detection for you: mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT); This makes mysqli throw exceptions when errors occur inside ...
potato's user avatar
  • 1,122
4 votes

Booking appointments with MySQLi and PHP

Code has to be readable if(isset($_POST['slots_booked'])) $slots_booked = mysqli_real_escape_string($link, $_POST['slots_booked']); Going through this code I ...
xReprisal's user avatar
  • 331
4 votes
Accepted

Secure database connection in PHP

You're asking the wrong question. The right question is "What should I use instead of query?" The answer is that if you want to reinvent the wheel, you should use ...
Peter Taylor's user avatar
  • 24.1k
4 votes
Accepted

PHP login page using prepared statements

There are several problems with your code. An extra query to get exactly the same row you just requested Unreliable password hashing Inconsistent query handling with strange query()/confirm() pair. ...
Your Common Sense's user avatar
4 votes

Restful resource with pagination and additional mapping

I am guessing that there is some bootstrapping script which is instantiating your slim application an including this controller, so my first thought is, if that is the case, shouldn't fundamental ...
Mike Brant's user avatar
  • 9,608
4 votes
Accepted

Loading CSV into MySQL using OOP PHP

So I would recommend to not extend the CSV parser from the Database class. Instead The CSV parser should get the Database per dependency injection through the constructor. Also I would not recommend ...
Christoph Kappestein's user avatar
4 votes
Accepted

Adding / updating user info into MySQL database

In your INSERT script: Use your config.php file everywhere instead of hardcoding your connection credentials. You should be checking that the POST elements actually exist before trying to access ...
mickmackusa's user avatar
  • 8,674

Only top scored, non community-wiki answers of a minimum length are eligible