49
votes
Accepted
Shielding your CodeReview on GitHub
On a personal note, your code is really clean, the idea is brilliant, and I really hope to see it implemented soon.
Your code is well implemented and structured, but there's syntax points that could ...
- 11.9k
29
votes
Shielding your CodeReview on GitHub
I guess this is about as beautiful as PHP gets :p
(I had not fun discovering this monstrosity.)
One minor suggestion I have is to eliminate the duplication here:
...
- 110k
20
votes
Shielding your CodeReview on GitHub
Disclamer:
My review will be short is longer than I expected but I will only focus on the function useData().
I've read it carefully and did my best to improve it ...
- 6,066
9
votes
Accepted
How secure is my PHP registration script?
You properly protect against SQL injection, that's good.
I worry about the filtering on the password. If I choose <script>' OR 1=1 ">>> as my ...
- 21.1k
8
votes
PDO wrapper with validation
Poor cohesion
It's called logical cohesion when a routine that does multiple things of different logic. Your function will either insert records, or select records, or update records.
These are very ...
- 363
8
votes
Accepted
PHP MySQL connection class
From the things I see in your code it looks to me like you are quite new to Object Oriented Programming (OOP), so I will try to keep that in mind during this review.
Basic OOP
The ...
- 837
8
votes
Accepted
A demonstrational example of a Data mapper ORM
I don't fully understand the desire for a "generic" data mapper. Oftentimes, flexibility leads to complexity and fragility in your application. Take for example your ...
- 9,603
7
votes
Accepted
Voting system for a website
A Vote should not have access to the database. It should be a dumb 'entity' with setters, getters and a constructor to make the required object a valid one.
You ...
- 421
7
votes
Class for reducing development time
Kind of an old post, but I had to add something where I saw this line
...
- 301
7
votes
Accepted
Slim API with 3 layer architecture
I've seen this layering before, in fact I'm working on a .NET project with this exact layering (DataAccessLayer and BusinessLayer). The BusinessLayer object does ...
- 5,589
6
votes
PHP PDO Helper Functions
Wrapping PDO: General Approach
Generally, wrapping PDO without actually adding any functionality is not recommended. See for example here, or pretty much any answer on basic PDO wrapper classes.
...
- 25k
6
votes
Web page to add a notice, with some validation
Good things
You are using PDO with parameterized queries, which is a really good thing. That should save you potential troubles between the application and the ...
- 20.3k
6
votes
Accepted
A simple PHP login system
Data Handling & Security
You use prepared statements, which protects you from SQL injection, which is good. However, the way you handle passwords could be improved to increase security.
It's not ...
- 25k
6
votes
Query to plot a histogram of song ratings
It would be better to use GROUP by in your SQL. By this way you will get rid of long SQL query.
...
- 61
6
votes
Accepted
Simple login script with sha256 hashing
There's a timing attack. To see whether a user has registered or not, I can try to login. If it fails fast, the user is not registered. If it takes time, the user is registered. To fix this ...
- 21.1k
6
votes
Accepted
Dynamic insert function for PDO (for any case)
I don't see any point in this function in its present form.
Given you've got a general purpose query function,
...
- 7,956
6
votes
How secure is my PHP registration script?
It will be better practice to url encoding the query string of your $activation_link in case the $fname is not url-compliant. I ...
- 8,334
6
votes
API for SQL queries with PHP PDO
On the Database class
In my experience, a language layer never creates a database. It would require a create database privilege for one thing. Although it's sort of ...
- 7,956
6
votes
Accepted
Is this PDO query okay to use in PHP OOP?
Nope, this "PDO query" is NOT okay, especially "to use in PHP OOP".
The Database class does nothing useful, and shouldn't exist.
The Query class should never extend the Database ...
- 7,956
5
votes
Accepted
PDO Insert function using PHP
Is it good practice to insert data into a table this way?
If by that you mean: is it considered good practice to use prepared statements, and a bind array, then yes. It is. If you mean: "can I ...
- 10.7k
5
votes
User registration and authentication in PHP and PDO
Preamble
Writing a secure user management and authentication system is not an easy task. It has many pitfalls and you should follow a lot of guidelines and best practices along the way.
Security and ...
- 2,204
5
votes
Proper use of mysqli->close();
The fact that mysqli has nothing to do with PDO aside, there are several things about your code at whole:
this "class Database" from some article is a dummy. It is absolutely useless and there is ...
- 7,956
5
votes
PDO MySQL queries for web application to reserve a vehicle
You are missing charset in your DSN and you have emulated prepared statements still on. This could potentially leave your vulnerable to SQL injection. See Are PDO prepared statements sufficient to ...
- 881
5
votes
Accepted
Does this PDO process look protected from SQL injection?
It looks like your script is part of a basic ajax searching technique.
$_POST is typically used when writing to the database (or when there is a distinct reason ...
- 8,334
5
votes
Accepted
Sanitizing user form input in php
I am concerned that you are not digesting the advice given in previous reviews, because you are ONLY to call htmlspecialchars() just before you print to an html ...
- 8,334
5
votes
Accepted
function for PDO queries and return result - tested - any tips?
First of all, it's a very good thing that you came to the idea of such a function. Sadly, but out of many people asking questions on Stack Overflow, only a handful ever come to such an idea. It means ...
- 7,956
5
votes
Accepted
Connect to MYSQL database in PHP with prepared statements
Sam's answer covers a lot of good points I am not going to repeat, but I will tell you more issues.
Private properties
What is the point in setting constants as private properties? What is the purpose ...
- 881
4
votes
Accepted
4
votes
PHP class architecture and dependency injection
Alright, let's start with your concerns, and then move on to the actual review:
A prepared statement costs about 50 times a normal statement. However, that cost is on the database server's side (i.e. ...
- 4,747
Only top scored, non community-wiki answers of a minimum length are eligible