31–40 of 101 posts
Just as a quick look, this thing is riddled w/ potential sql injections..a number of unchecked/unescaped uri controlled variables. In some cases there's validation of numerics w/ +=0, but in many cases (e.g. $sort_col) there's none.
you mean you shouldn't trust user input?
What exactly did you dislike about CodeIgniter? For me CodeIgniter is probably what I'd use if I had to go back to making PHP applications so I'd like to hear any reasons you had against it.
CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…
I can't believe you hardcoded this for MySQL instead of using PHP's excellent and versatile PDOs, and I can't believe the 10k line count. Gosh. Is "de-engineering" a suitable term here? Thumbs up for open sourcing your work, though.
No I'm serious here, renownedmedia. Don't disregard my rant with a silly downvote, but do instead indulge yourself in the PDO methods instead of painting yourself and your projects into corners: http://php.net/manual/en/book.pdo.php
Seriously though I agree with your point about PDO. Perhaps the down-vote was due to the comment about de-engineering and apparently making fun of 10k LOC?
I took a look at the app and it's got a huge amount of features. 10k is not really that much code for a "enterprise" app I suppose you could call it. The OP probably is just trying to express the amount of labor that went into the app. Unfortunately other developers may judge your LOC as either a positive or negative, so it's probably best to avoid mentioning it (unless you've written an app in an unbelievably low number of lines).
Earlier quoted context omitted.
I've a few questions if you have the time. Did you never charge? Or were you charging? What were the reasons it was / you were not ready to make it a money making business? Any mistakes or lessons learned while building/running the software? Where did the 120 users come from? As someone who is looking to create their own product soon I'd be really grateful for any response you can give. Thanks Alan
For a few months I had the ability for users to sign up for a paid account, but I never pushed it. After that, I just disabled the feature altogether. The most advertising I did do was a 125x125 ad on a website used by web developers (DavidWalsh.name) for one month. I didn't get a single user through that ad though. The biggest lesson learned is that an app like this really needs someone who is good at marketing. I'm…
Earlier quoted context omitted.
I've a few questions if you have the time. Did you never charge? Or were you charging? What were the reasons it was / you were not ready to make it a money making business? Any mistakes or lessons learned while building/running the software? Where did the 120 users come from? As someone who is looking to create their own product soon I'd be really grateful for any response you can give. Thanks Alan
For a few months I had the ability for users to sign up for a paid account, but I never pushed it. After that, I just disabled the feature altogether. The most advertising I did do was a 125x125 ad on a website used by web developers (DavidWalsh.name) for one month. I didn't get a single user through that ad though. The biggest lesson learned is that an app like this really needs someone who is good at marketing. I'm…
Also I know you're getting a lot of stick in this thread for the code which I feel is unjustified, I just want to say I commend you for open sourcing it.
Earlier quoted context omitted.
CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…
I'm not comp sci educated, I'm all self taught so maybe "Autoload" has a real meaning outside of this context, but CI does have an autoloader... something that can autoload libraries and models? application/config/autoload.php
Also another question would be which frameworks is he currently using and what are its advantages.
Earlier quoted context omitted.
CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…
I'm not comp sci educated, I'm all self taught so maybe "Autoload" has a real meaning outside of this context, but CI does have an autoloader... something that can autoload libraries and models? application/config/autoload.php
Earlier quoted context omitted.
For a few months I had the ability for users to sign up for a paid account, but I never pushed it. After that, I just disabled the feature altogether. The most advertising I did do was a 125x125 ad on a website used by web developers (DavidWalsh.name) for one month. I didn't get a single user through that ad though. The biggest lesson learned is that an app like this really needs someone who is good at marketing. I'm…
Thank you very much for taking the time to reply! Also I know you're getting a lot of stick in this thread for the code which I feel is unjustified, I just want to say I commend you for open sourcing it.
Earlier quoted context omitted.
The arguments to controller methods (in CI) are passed through some regular expressions. CI goes as far as to destroy all GET variables (which I highly disagree with).
GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..