Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just open sourced my 10k LOC PHP & MySQL invoicing app

github.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#61

Post by renownedmedia »

TazeTSchnitzel wrote: post #59
renownedmedia wrote: post #56

Earlier quoted context omitted.

I have the exact same sentiment; I pretty much open source all of my old projects for people to learn from (I taught a small meetup for a while, it was useful to explain both the good and the bad). I add DEFUNCT to the description if they are really old or have a lot of bad practices. Here's the rest: https://github.com/tlhunter

That's an excellent idea. I should go add that to some of my horrible, horrible C code, lest someone think that 10 levels of indentation, not using c-style strings, non-portability, architecture assumptions, lack of error checking, and blocking sockets is a good idea... Or that macros without bounds checking that cause segfaults unless debugging is a good idea... What was I thinking?

Heh, I'm not well versed in C, but it sounds scary.

You can also throw comments in the code where the bad stuff is so that it has more visibility, as well as suggestions for how to better solve the problem. Sometimes people learn best from bad code!

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#62

Post by TazeTSchnitzel »

renownedmedia wrote: post #61
TazeTSchnitzel wrote: post #59

Earlier quoted context omitted.

That's an excellent idea. I should go add that to some of my horrible, horrible C code, lest someone think that 10 levels of indentation, not using c-style strings, non-portability, architecture assumptions, lack of error checking, and blocking sockets is a good idea... Or that macros without bounds checking that cause segfaults unless debugging is a good idea... What was I thinking?

Heh, I'm not well versed in C, but it sounds scary. You can also throw comments in the code where the bad stuff is so that it has more visibility, as well as suggestions for how to better solve the problem. Sometimes people learn best from bad code!

Good idea.

It should sound scary, it's the worst code I've ever written.

I wrote it 2 years ago with the idea "working first, correct later", but I haven't finished the latter yet...

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#63

Post by renownedmedia »

jakejake wrote: post #33
markhuus wrote: post #10

Earlier quoted context omitted.

No I'm serious here, renownedmedia. Don't disregard my rant with a silly downvote, but do instead indulge yourself in the PDO methods instead of painting yourself and your projects into corners: http://php.net/manual/en/book.pdo.php

Your very first comment on HN got a down-vote, I haven't actually seen a -5 karma before. On the bright side you've nowhere to go but up. Seriously though I agree with your point about PDO. Perhaps the down-vote was due to the comment about de-engineering and apparently making fun of 10k LOC? I took a look at the app and it's got a huge amount of features. 10k is not really that much code for a "enterprise" app I sup…

It was the first metric that came to mind, it was hard to describe in time since development was on and off for a while. I just wanted people to know it wasn't a small project.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#64

Post by justinkelly »

great to see this open sourced - sorry to hear you closed neoinvoice though

the web based invoicing market is extremely crowded and very hard to complete against the likes of freshbooks.com

though i went the opposite route to you and its working $ for me

created the open source app http://simpleinvoices.org first, got large user based, then offered premium hosting at http://smarterinvoices.com

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#65

Post by lftl »

renownedmedia wrote: post #55
chrismsnz wrote: post #48

Earlier quoted context omitted.

I'm not the OP but almost any PHP project these days has me reaching for Symfony 2[0] or her little brother Silex[1] paired with Doctrine 2[2]. [0]. http://symfony.com/ [1]. http://silex.sensiolabs.org/ [2]. http://www.doctrine-project.org/

Symfony is nice, Zend 2 is going to fix everything from ZF1 and is worth keeping an eye on as well. I've dabbled in Doctrine before, but the memory usage looked a little too high for the convenience it offered.

Out of curiosity what are you doing in PHP where memory usage is an issue? PHP's standard life cycle, while having numerous disadvantages, avoids a lot of problems with memory usage.

It's a rather different beat, but you might checkout Propel (http://propelorm.org) for a different take on a PHP ORM. It has a static build phase unlike Doctrine which turns some people off, but if you can get past that it's a rather nice ORM.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#66

Post by lftl »

renownedmedia wrote: post #20
PleaseBeSerious wrote: post #15

What would you do different based on what you know now?

While I was at a startup recently, I did all of my frontend development in Backbone.js, this app would do a lot better in that framework. Also, the CI framework isn't all that great, I would have certainly used a different framework. Perhaps even Node.js (which is what I'm doing a lot of my development in nowadays). I also would have looked for a marketer and devoted more time to the project. The market for this kind…

I'm curious why you would choose Node.js instead today. I've done a little Node.js work, and I would unequivocally use it again for anything that needs a fair amount of concurrency, or high volume, lightweight requests. Other than that though, the only advantage I see over other server side stacks is a slight mental bonus in using the same language on both the client and server? Are there any other major advantages you see over PHP/Python/Ruby,etc. stacks?

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#67

Post by mmmooo »

notJim wrote: post #42
mmmooo wrote: post #19

Just as a quick look, this thing is riddled w/ potential sql injections..a number of unchecked/unescaped uri controlled variables. In some cases there's validation of numerics w/ +=0, but in many cases (e.g. $sort_col) there's none.

Skimming the code, it looks like input is being escaped in the SQL queries. Can you link to examples?

Just skimming, and e.g.

in: controllers/invoice.php

$data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col);

$sort_col appears to be just uri_segment 2 of list_items.

select_multiple() then calls:

$sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id) . " ORDER BY $sort_col";

$sort_col is left as-is. It is certainly more difficult, since '()' aren't permitted in the uri, and we're already in the ORDER BY clause, but I think it may still be doable to get some blindsql into there.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#68

Post by scoot »

renownedmedia wrote: post #38
Alan01252 wrote: post #35

Earlier quoted context omitted.

Thank you very much for taking the time to reply! Also I know you're getting a lot of stick in this thread for the code which I feel is unjustified, I just want to say I commend you for open sourcing it.

Thanks for the encouragement! I get flack from everything I open, must be a sign.

It's a sign that people are interested in,and paying attention to your code. Take it as a compliment!

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#69

Post by renownedmedia »

lftl wrote: post #65
renownedmedia wrote: post #55

Earlier quoted context omitted.

Symfony is nice, Zend 2 is going to fix everything from ZF1 and is worth keeping an eye on as well. I've dabbled in Doctrine before, but the memory usage looked a little too high for the convenience it offered.

Out of curiosity what are you doing in PHP where memory usage is an issue? PHP's standard life cycle, while having numerous disadvantages, avoids a lot of problems with memory usage. It's a rather different beat, but you might checkout Propel ( http://propelorm.org ) for a different take on a PHP ORM. It has a static build phase unlike Doctrine which turns some people off, but if you can get past that it's a rather n…

With this project in particular, each time someone hits the main page there are 6 php scripts executed in parallel. I was hitting some limits with my VPS during those spikes.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#70

Post by notJim »

mmmooo wrote: post #67
notJim wrote: post #42

Earlier quoted context omitted.

Skimming the code, it looks like input is being escaped in the SQL queries. Can you link to examples?

Just skimming, and e.g. in: controllers/invoice.php $data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col); $sort_col appears to be just uri_segment 2 of list_items. select_multiple() then calls: $sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id…

Ugh, yup. This code should either be taken down, or come with a HUGE warning that it needs to be audited for security vulnerabilities.
Post reply on HN