Hot answers tagged

9 votes
Accepted

How secure is my PHP registration script?

You properly protect against SQL injection, that's good. I worry about the filtering on the password. If I choose <script>' OR 1=1 ">>> as my ...
Roland Illig's user avatar
  • 21.3k
8 votes
Accepted

PHP MySQL connection class

From the things I see in your code it looks to me like you are quite new to Object Oriented Programming (OOP), so I will try to keep that in mind during this review. Basic OOP The ...
Thijs Riezebeek's user avatar
8 votes
Accepted

A demonstrational example of a Data mapper ORM

I don't fully understand the desire for a "generic" data mapper. Oftentimes, flexibility leads to complexity and fragility in your application. Take for example your ...
Mike Brant's user avatar
  • 9,598
6 votes

Query to plot a histogram of song ratings

It would be better to use GROUP by in your SQL. By this way you will get rid of long SQL query. ...
Unnamed's user avatar
  • 61
6 votes
Accepted

Simple login script with sha256 hashing

There's a timing attack. To see whether a user has registered or not, I can try to login. If it fails fast, the user is not registered. If it takes time, the user is registered. To fix this ...
Roland Illig's user avatar
  • 21.3k
6 votes
Accepted

Dynamic insert function for PDO (for any case)

I don't see any point in this function in its present form. Given you've got a general purpose query function, ...
Your Common Sense's user avatar
6 votes

How secure is my PHP registration script?

It will be better practice to url encoding the query string of your $activation_link in case the $fname is not url-compliant. I ...
mickmackusa's user avatar
  • 8,574
6 votes

API for SQL queries with PHP PDO

On the Database class In my experience, a language layer never creates a database. It would require a create database privilege for one thing. Although it's sort of ...
Your Common Sense's user avatar
6 votes
Accepted

Is this PDO query okay to use in PHP OOP?

Nope, this "PDO query" is NOT okay, especially "to use in PHP OOP". The Database class does nothing useful, and shouldn't exist. The Query class should never extend the Database ...
Your Common Sense's user avatar
6 votes

A simple PHP login form with PDO

General review Consider restricting access to init script At first I saw lib/app_init.php and wondered why a login script would need to alter database tables. ...
Sᴀᴍ Onᴇᴌᴀ's user avatar
5 votes

User registration and authentication in PHP and PDO

Preamble Writing a secure user management and authentication system is not an easy task. It has many pitfalls and you should follow a lot of guidelines and best practices along the way. Security and ...
insertusernamehere's user avatar
5 votes

Proper use of mysqli->close();

The fact that mysqli has nothing to do with PDO aside, there are several things about your code at whole: this "class Database" from some article is a dummy. It is absolutely useless and there is ...
Your Common Sense's user avatar
5 votes

PDO MySQL queries for web application to reserve a vehicle

You are missing charset in your DSN and you have emulated prepared statements still on. This could potentially leave your vulnerable to SQL injection. See Are PDO prepared statements sufficient to ...
Dharman's user avatar
  • 881
5 votes
Accepted

Does this PDO process look protected from SQL injection?

It looks like your script is part of a basic ajax searching technique. $_POST is typically used when writing to the database (or when there is a distinct reason ...
mickmackusa's user avatar
  • 8,574
5 votes
Accepted

Sanitizing user form input in php

I am concerned that you are not digesting the advice given in previous reviews, because you are ONLY to call htmlspecialchars() just before you print to an html ...
mickmackusa's user avatar
  • 8,574
5 votes
Accepted

function for PDO queries and return result - tested - any tips?

First of all, it's a very good thing that you came to the idea of such a function. Sadly, but out of many people asking questions on Stack Overflow, only a handful ever come to such an idea. It means ...
Your Common Sense's user avatar
5 votes
Accepted

Connect to MYSQL database in PHP with prepared statements

Sam's answer covers a lot of good points I am not going to repeat, but I will tell you more issues. Private properties What is the point in setting constants as private properties? What is the purpose ...
Dharman's user avatar
  • 881
5 votes

A simple PHP login form with PDO

As whole, it's a very robust code. Only some inconsistences can be improved. Error reporting I would start from the infamous piece of code, which fallacy is only matched by its enormous popularity: <...
Your Common Sense's user avatar
4 votes
Accepted

PHP Dynamic QueryBuilder function - Security

Security and Readability So here I assume that the user cannot maliciously enter their own input (I may be wrong, please correct me if so). Yes, you are wrong about that. ...
tim's user avatar
  • 25.1k
4 votes
Accepted

Possibility of SQL Injection

SQL Injection Am I opening myself up to SQL Injection with the current way I am building the SQL? Yes, you are very likely open to SQL injection. Here are code pieces that look vulnerable: <...
tim's user avatar
  • 25.1k
4 votes

A class to add and select players within a database

Calling get_player twice is not a good idea, as each time a db query is necessary. As you are asking about OOP: You could add an actual ...
tim's user avatar
  • 25.1k
4 votes

Dynamically generated menu based on privileges

Security You are very likely open to SQL injection. You should never directly put variables into queries, and you really need to use prepared statements. You are also likely open to persistent XSS, ...
tim's user avatar
  • 25.1k
4 votes

PHP Login script getting bypassed allowing access to my admin pages

Security Redirect and Broken Authentication A client does not have to follow a header redirect. This means that code below such a redirect can be executed by anyone. This means that your whole ...
tim's user avatar
  • 25.1k
4 votes

A like/unlike system using MySQL and PDO

This design is a consequence of a poorly designed API. It looks like the client will hit one URL that will cause the like/unlike state to be toggled. But what if the user has multiple tabs open on the ...
200_success's user avatar
4 votes

PHP MySQL connection class

The answer provided by @ThijsRiezebeek gives really good information about moving your class towards using a singleton pattern. Since you mentioned dependency injection (though you are not currently ...
Mike Brant's user avatar
  • 9,598
4 votes

PHP login form with PDO

Always authenticate the user before you take any restricted action. In login.php you have: ...
BeetleJuice's user avatar
4 votes

Checking a user's emails using an ID

Some thoughts: You should strongly consider using appropriate datetime, timestamp, etc. column types when storing date and/or time information in your DB. Unix timestamps may seem simple for working ...
Mike Brant's user avatar
  • 9,598
4 votes

Connecting to a database and running CRUD operations

I think the database class as you wrote it has no use. You write a database class to provide an easier interface with the database. Instead you split up queries into multiple parts, but are still ...
Sumurai8's user avatar
  • 2,595
4 votes

PHP PDO Wrapper

When I saw the title of this question, I immediately thought of one of my earlier reviews on this site. The first thing I said there, applies to your code, too: IMHO, all PDO wrappers are, essentially ...
Elias Van Ootegem's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible