Decided to bite the bullet and learn PHP, which is used for nearly everything at my job. My starting voyage was to mess around with “pure php”, as in, no frameworks, no libraries, not even javascript, just the basic server with v8.3 running and some (currently very shitty) CSS styling.

So, I decided to go with a 2 step process: first, a site for me to post my stuff, with the possibility for external users to make accounts and leave comments. Step 2 would be making a forum where said users can interact. Before I began coding anything, I wrote down the database specification, though it’s still “open for debate”. I also didn’t pay attention and made all tables as MyISAM initially instead of InnoDB, which made me lose all foreign keys, thankfully easily remedied given the small size of the project.

Thus far, I’ve got the user creation, listing, login (with hashed password), post creation and post viewing working. Visitors, normal users and admin see different links and forms, depending on pages, all with inline php code in appropriate pages - for instance, (unlogged) visitors don’t see a comment box when reading a post. I’m currently working on the user edit page.

Anyway, why do I think I’m doing a lot of “wrongs”? For starters, I’m not using classes. At all. Functions are being added “globally” to one of 3 include somepage.php; that are in every page; every database related function - select all, select 1, update, are all in the db.php file. So, every page load is also loading the entire list of database functions, plus a bunch of html-automation related functions, even when none of them are used. Since PDO::fetch() returns an array with mapped keys (ie: $result['column1']), I feel like I have “no good reason” to use classes, especially as I’m still putting some finishing touches on the tables. I mean, I can access the relevant data with $bla['column_name'];, which is all I need thus far.

A lot of the resulting html comes from echo, some of it from functions to handle it more easily, like passing an array so a “global” function of mine returns it as neatly organized <td> elements.

There is no MVC, just good ol’ <a href> and <form method=post> where they need to be. All my forms’ actions call a separate php page that’s just code to handle the form, always as POST, in order to check blank fields, size and character constraint, etc.

I’ve no doubt that, as is, my project has a number of security holes, though cross-site scripting and session poisoning are not among them. I did try sql injection and couldn’t get it to work, so good on me.

As awful as this project might be against “the real world” use, I feel weirdly proud of what I’m achieving. Is there a name for this feeling, of pride for something you know is subpar?

  • The Bard in Green@lemmy.starlightkel.xyzEnglish
    1·
    7 hours ago

    On the one hand, you do have good reasons to use classes.

    1. Interacting with your database.
    2. Sanitizing your inputs.
    3. Building pages from templates.

    Rather than piecemeal loading all these functions from every page where a bunch of them aren’t being used, you can create three classes.

    1. has all your database interactions in it and then you can treat all database interactions as an object. My queries are usually all executed with $Data->runQuery();

    2. Since you’re working in raw PHP with no frameworks or libraries, you NEED to validate every input users send, or bots are going to spam the shit out of your database. The way you have things now, you’re probably either calling some function(s) on every form submit (every time $_SERVER[‘request_method’]===‘POST’) OR you’re just not doing it. When working in raw PHP, I always write a Validator class which sits in between every $_GET and $_POST and makes damn sure what ever is coming in meets a set of criteria that I expect. I’m happy to go into the architecture of this with you if that would be helpful.

    3. I’m assuming you might have something for each page like

    include(‘header.php’);

    <my page specific PHP is here>

    include(‘footer.php’);

    Instead, I like to write a page builder class that constructs my pages dynamically based on routing. So then any given page becomes and instance of $Page and you populate it with various methods (like $Page->renderForm(‘form’);) You can also then base the routing logic on your form submissions.

    On the other hand… it’s probably fine at this stage to just not use classes and if it works, why fix it?

    You probably feel like you don’t have a need for classes because you’re just not comfortable working with them yet, and need more experience thinking through architecture. This is fine. This is normal. This is exactly where you should be, given what you say about your experience level.

    SQL injection probably didn’t work because PDO protects you from that to some extent. Doesn’t mean you shouldn’t account for it in your input processing.

    Most of my HTML comes from echo.

    Good, it should. I effing HATE reading through code where people are tagging in and out of PHP all the time. It looks so ugly. That’s not a standard best practice, just MY personal practice. IMHO, for HUMAN readability purposes, HTML should either be in echos or template files.

    I fricken hate this: <a> <bunch> <of> <html> <php? run_some_php('here'); />

    Don’t effing make me read that. I co-run an independent coding shop and whenever we work in PHP, I tell people please not to do that.

      • The Bard in Green@lemmy.starlightkel.xyzEnglish
        1·
        1 hour ago

        Very rarely, but probably only in situations where you would too. No, usually I put my HTML in HTML files. They’re usually building blocks… page components, not a full page. I regulate the page flow in PHP, and I don’t like it cluttered up with tons of HTML, inside or outside of echos. I have been known to do stuff like this though:

        echo “<div class=‘whatever-container’>”.$Page->pagecomponents[‘contents_of_some_html_file’].“</div>”;

        If I go and look at $Page, it will show that $this->pagecomponents is set by reading my template files in so I can grab HTML structures dynamically. If the contents of pagecomponents[‘component’] are set dynamically (they usually are), there won’t be some ugly <php ?> tag in the HTML file, but my $Page class will handle populating it somehow. The architecture I usually use is $Validator is instantiated for a page load, then $Data, so whatever user activity $Validator has detected and cleaned up tells $Data what to do with the data backend (which is usually a combination of Maria and Redis) then $Data gets fed into $Page which figures out what page to build, looks at all my HTML building blocks and figures out how to put them together and populate whatever it needs to. So it will usually be something like (very simplistically)

        $Validator = new Validator($_GET, $_POST);

        $Data = new Data($Validator);

        $Page = new Page($Data);

        renderPage($Page->Page);

    • luciole (they/them)@beehaw.org
      3·
      7 hours ago

      A template is literally an HTML file with some PHP tags sprinkled to feed in the data. Echoing large swaths of HTML is weird. And PHP tag syntax is actually <?php hello(); ?>.