9
votes
Accepted
How secure is my PHP registration script?
You properly protect against SQL injection, that's good.
I worry about the filtering on the password. If I choose <script>' OR 1=1 ">>> as my ...
- 21.3k
8
votes
Accepted
A demonstrational example of a Data mapper ORM
I don't fully understand the desire for a "generic" data mapper. Oftentimes, flexibility leads to complexity and fragility in your application. Take for example your ...
- 9,638
6
votes
Query to plot a histogram of song ratings
It would be better to use GROUP by in your SQL. By this way you will get rid of long SQL query.
...
- 61
6
votes
Accepted
Simple login script with sha256 hashing
There's a timing attack. To see whether a user has registered or not, I can try to login. If it fails fast, the user is not registered. If it takes time, the user is registered. To fix this ...
- 21.3k
6
votes
Accepted
Dynamic insert function for PDO (for any case)
I don't see any point in this function in its present form.
Given you've got a general purpose query function,
...
- 8,783
6
votes
How secure is my PHP registration script?
It will be better practice to url encoding the query string of your $activation_link in case the $fname is not url-compliant. I ...
- 8,684
6
votes
API for SQL queries with PHP PDO
On the Database class
In my experience, a language layer never creates a database. It would require a create database privilege for one thing. Although it's sort of ...
- 8,783
6
votes
Accepted
Is this PDO query okay to use in PHP OOP?
Nope, this "PDO query" is NOT okay, especially "to use in PHP OOP".
The Database class does nothing useful, and shouldn't exist.
The Query class should never extend the Database ...
- 8,783
6
votes
A simple PHP login form with PDO
General review
Consider restricting access to init script
At first I saw lib/app_init.php and wondered why a login script would need to alter database tables. ...
- 28.2k
5
votes
User registration and authentication in PHP and PDO
Preamble
Writing a secure user management and authentication system is not an easy task. It has many pitfalls and you should follow a lot of guidelines and best practices along the way.
Security and ...
- 2,224
5
votes
Proper use of mysqli->close();
The fact that mysqli has nothing to do with PDO aside, there are several things about your code at whole:
this "class Database" from some article is a dummy. It is absolutely useless and there is ...
- 8,783
5
votes
PDO MySQL queries for web application to reserve a vehicle
You are missing charset in your DSN and you have emulated prepared statements still on. This could potentially leave your vulnerable to SQL injection. See Are PDO prepared statements sufficient to ...
- 881
5
votes
Accepted
Does this PDO process look protected from SQL injection?
It looks like your script is part of a basic ajax searching technique.
$_POST is typically used when writing to the database (or when there is a distinct reason ...
- 8,684
5
votes
Accepted
Sanitizing user form input in php
I am concerned that you are not digesting the advice given in previous reviews, because you are ONLY to call htmlspecialchars() just before you print to an html ...
- 8,684
5
votes
Accepted
function for PDO queries and return result - tested - any tips?
First of all, it's a very good thing that you came to the idea of such a function. Sadly, but out of many people asking questions on Stack Overflow, only a handful ever come to such an idea. It means ...
- 8,783
5
votes
Accepted
Connect to MYSQL database in PHP with prepared statements
Sam's answer covers a lot of good points I am not going to repeat, but I will tell you more issues.
Private properties
What is the point in setting constants as private properties? What is the purpose ...
- 881
5
votes
A simple PHP login form with PDO
As whole, it's a very robust code. Only some inconsistences can be improved.
Error reporting
I would start from the infamous piece of code, which fallacy is only matched by its enormous popularity:
<...
- 8,783
4
votes
Checking a user's emails using an ID
Some thoughts:
You should strongly consider using appropriate datetime, timestamp, etc. column types when storing date and/or time information in your DB. Unix timestamps may seem simple for working ...
- 9,638
4
votes
Connecting to a database and running CRUD operations
I think the database class as you wrote it has no use. You write a database class to provide an easier interface with the database. Instead you split up queries into multiple parts, but are still ...
- 2,595
4
votes
PHP PDO Wrapper
When I saw the title of this question, I immediately thought of one of my earlier reviews on this site. The first thing I said there, applies to your code, too: IMHO, all PDO wrappers are, essentially ...
- 10.9k
4
votes
Simple PDO database class in PHP
My suggestion is to not do what you are trying to do. Why do you want to wrap PDO?
This is a common type of code review that I see here and in most cases the attempt to "wrap" a perfectly good ...
- 9,638
4
votes
PDO Insert Method
The challenge I have when I see people trying to build these sorts of general use database interaction classes, is that they most typically add limited value to the code base while more often then not ...
- 9,638
4
votes
Accepted
PDO Insert Method
The code, for what it is, looks fine. You're using prepared statements, which is a good thing, and the code comments help to understand what it does.
The real problem that I see is more of a design ...
- 20.4k
4
votes
Ajax Voting System
I'm only going to address the PHP and SQL code and the general voting mechanism.
I can hardly imagine that multiple blog items share the same id. Therefor, the ...
- 348
4
votes
Accepted
Displaying a paginated list of forum topics using PHP PDO
This code is safe from the SQL injection standpoint but it is likely prone to XSS because of the untreated output, and also to possibly leak the sensitive information due to the error message ...
- 8,783
4
votes
Accepted
Mysql PDO Wrapper that throws Unique Constraint Exception
This code is so good that it's the first time I have nothing to say.
Your approach to the problem is absolutely correct and you should keep using it.
There could be only microscopic nuances, such as ...
- 8,783
4
votes
Accepted
Storing and confirming user input
Your code is good enough at preventing sql injection. But it sucks (pardon me) in everything else.
Don't print database error to the user.
Don't put echoes into your logic.
Don't double last letters ...
- 5,477
4
votes
Using a transaction to create account records
Does this appear as proper use of the commit and rollback functions?
I honestly haven't used PDO functions directly - typically used a framework like Laravel or similar.
I do agree with the advice on ...
- 28.2k
4
votes
Using a transaction to create account records
Retrieving the ID of newly-created user should not be done like this:
$select = $dbc->prepare("SELECT MAX(uid)+1 AS 'NEWUID' FROM mainTable");
Instead ...
- 7,338
Only top scored, non community-wiki answers of a minimum length are eligible