Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just open sourced my 10k LOC PHP & MySQL invoicing app

github.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#41

Post by renownedmedia »

mmmooo wrote: post #29
renownedmedia wrote: post #27

Earlier quoted context omitted.

The arguments to controller methods (in CI) are passed through some regular expressions. CI goes as far as to destroy all GET variables (which I highly disagree with).

GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..

I would be excited to see an example exploit executed against the app, I've tried plenty of times without success.

Any pull request to fix a vulnerability will be happily accepted!

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#42

Post by notJim »

mmmooo wrote: post #19

Just as a quick look, this thing is riddled w/ potential sql injections..a number of unchecked/unescaped uri controlled variables. In some cases there's validation of numerics w/ +=0, but in many cases (e.g. $sort_col) there's none.

Skimming the code, it looks like input is being escaped in the SQL queries. Can you link to examples?

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#43

Post by iends »

renownedmedia wrote: post #22
swang wrote: post #16

What exactly did you dislike about CodeIgniter? For me CodeIgniter is probably what I'd use if I had to go back to making PHP applications so I'd like to hear any reasons you had against it.

CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…

What PHP framework would you use if you had to today? Kohana? Yii? Something else?

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#44

Post by jwdunne »

markhuus wrote: post #8

I can't believe you hardcoded this for MySQL instead of using PHP's excellent and versatile PDOs, and I can't believe the 10k line count. Gosh. Is "de-engineering" a suitable term here? Thumbs up for open sourcing your work, though.

Please can you point me to documentation that shows that you can easily switch vendor when using PDO? The PHP docs clearly state database abstraction isn't purpose of PDO. The purpose of PDO is to abstract access to a database.

http://www.php.net/manual/en/intro.pdo.php

In this sense, wouldn't it have been better to either recommend that he should have used a DBA library? Or even recommend that he used PDO in place of CodeIgniter's own DB access library?

The OP's experience aside, I think you're also missing that this was written on top of CodeIgniter. From my own experience and learning, CodeIgniter isn't really the best tool for writing larger applications. It's architecture isn't so great and is largely a remanent of the past. To end a rant about CodeIgniter short, it seems more natural to write namespaced procedures using classes rather than taking full advantage of objects and OO (again, probably due to it being largely a PHP4 framework).

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#45

Post by renownedmedia »

danso wrote: post #39

I didn't look through the PHP or MySQL code but the front-end has a clean look (from the video), which is more than is expected from most people who take it upon themselves to develop an invoicing system

Thanks! The public facing layout went through three major revisions and the final one is based on 960.gs. The layout of the app is governed by MochaUI, but it is a custom theme.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#46

Post by renownedmedia »

iends wrote: post #43
renownedmedia wrote: post #22

Earlier quoted context omitted.

CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…

What PHP framework would you use if you had to today? Kohana? Yii? Something else?

I started using Kohana after moving on from CI, but these days, I don't do as much PHP development. It's mostly Node.js development now.

I did start rebuilding this in Kohana a few months ago with the intention of rebuilding it as a less panel-y looking interface, but ended up scrapping the project.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#47

Post by mmmooo »

rokhayakebe wrote: post #40
mmmooo wrote: post #29

Earlier quoted context omitted.

GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..

I think CI rejects anything in the URI which isn't alpha-numeric. Would that solve the issue?

Kind of, anything in permited_uri_chars is allowed. This includes spaces, slashes, commas, %, and a handful of others by default. As I said only skimmed quickly so maybe I'm missing it. Will take a deeper look in a bit once not on mobile.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#48

Post by chrismsnz »

iends wrote: post #43
renownedmedia wrote: post #22

Earlier quoted context omitted.

CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers). //CI Class Load Example: $this->load->library('e…

What PHP framework would you use if you had to today? Kohana? Yii? Something else?

I'm not the OP but almost any PHP project these days has me reaching for Symfony 2[0] or her little brother Silex[1] paired with Doctrine 2[2].

[0]. http://symfony.com/ [1]. http://silex.sensiolabs.org/ [2]. http://www.doctrine-project.org/

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#49

Post by ericingram »

jumby wrote: post #30
renownedmedia wrote: post #26

Earlier quoted context omitted.

Yeah, there is a ton of competition. I started building this without having done proper research.

See, the thing is: creating an invoice is an 'accounting' event that needs to be thought out a bit. Like a double entry general ledger, receiving payments, proper audit trails, the inability to modify an invoice after 'posting' it, batches, periods, and other goodness. Otherwise, you get this ugly term: embezzlement. But kudos for opensourcing it and standing up to criticism from hecklers like me.

I disagree, as a business should think first in the broad context of product/market fit, which is a very dynamic issue, and not all markets need the kind of depth in an accounting product you describe.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#50

Post by renownedmedia »

rokhayakebe wrote: post #40
mmmooo wrote: post #29

Earlier quoted context omitted.

GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..

I think CI rejects anything in the URI which isn't alpha-numeric. Would that solve the issue?

This is the escaping mechanism I was using.
Post reply on HN