EdR comments made


profile / submitted / saved / comments / tutorial comments
RSS feed
EdRApril 12, 2008
view tutorial

This is one of the few quality tutorials on this site.

EdRApril 12, 2008
view tutorial

This tutorial is a *BAD* idea and demonstrates shockingly bad design, ideas, and code practices. Not that bad PHP is a surprise, but the point stands. You show little skill with the language and obviously do not understand how the LAMP stack works.

You should *never* be using raw MySQL queries unless you know what you are doing; you obviously do not. You should always be using a wrapper to allow for formatted queries in the form of prepared statements, specifically with PDO ( http://php.net/pdo ) or MDB2 ( http://pear.php.net/MDB2 ).

If you *are* going to use raw MySQL queries, you need to be at least somewhat cognizant of failure. This code is ripe for SQL injection when used by a less-than-competent programmer; a function to neuter any data passed as a query string is essential. (You do not need such a function when using PDO or MDB2; when you pass the prepared statement a variable it automatically handles variable neutering.) Given a naive user of this code, I would expect them to simply pass the value of a $_GET entry into engine::fetchtemplate(), at which point I simply pass the literal shown below in as that GET value:

unimportant'; EMPTY templates; SELECT * FROM templates WHERE templatename = '

The above string would cause your query to empty your database. Something tells me that's not quite a good idea.

Furthermore, the entire idea behind your incredibly basic "system" is foolish. Unless you know why you are storing your *static pages* as database entries, you're doing it wrong. It isn't "easier to manage and edit"; that's preposterous when you have the option of tools with built-in SFTP controls. This is wankery for the sake of wankery and does not provide any substantial benefits.

(Oh, and a tip: this doesn't "separate code and design" at all.)

Learn to program and learn to think before writing "tutorials" that will be more likely to harm learning programmers than help them.