Live data from Hacker News

Just open sourced my 10k LOC PHP & MySQL invoicing app

github.com

81–90 of 101 posts

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#81
post #67
post #42

Earlier quoted context omitted.

Skimming the code, it looks like input is being escaped in the SQL queries. Can you link to examples?

Just skimming, and e.g. in: controllers/invoice.php $data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col); $sort_col appears to be just uri_segment 2 of list_items. select_multiple() then calls: $sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id…

This is indeed a bug:

http://neoinvoice.local/invoice/list_items/1/asdf

Does cause an erroneous query. It should use a case statement to check against column names. CI will strip out any special characters though.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#82
post #70
post #67

Earlier quoted context omitted.

Just skimming, and e.g. in: controllers/invoice.php $data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col); $sort_col appears to be just uri_segment 2 of list_items. select_multiple() then calls: $sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id…

Ugh, yup. This code should either be taken down, or come with a HUGE warning that it needs to be audited for security vulnerabilities.

All projects which have been just open sourced are going to contain bugs. That is, until people like you find them and fix them and submit pull requests ;).

CI strips out all funky characters, so while it is possible to cause an erroneous query, I'm not seeing a security issue here.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#83
post #70
post #67

Earlier quoted context omitted.

Just skimming, and e.g. in: controllers/invoice.php $data['invoices'] = $this->invoice_model->select_multiple($this->session->userdata('company_id'), $page, $this->pref_user['per_page'], TRUE, $sort_col); $sort_col appears to be just uri_segment 2 of list_items. select_multiple() then calls: $sql = "SELECT id, name, DATEDIFF(NOW(), duedate) AS past_due FROM invoice WHERE company_id = " . $this->db->escape($company_id…

Ugh, yup. This code should either be taken down, or come with a HUGE warning that it needs to be audited for security vulnerabilities.

One recommendation I have is to try to get a security guru on your team. LedgerSMB would be nowhere near as secure if it weren't for the efforts of Seneca Cunningham early on in the project. My coding and sensitivity to these issues has greatly improved.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#85
post #8

I can't believe you hardcoded this for MySQL instead of using PHP's excellent and versatile PDOs, and I can't believe the 10k line count. Gosh. Is "de-engineering" a suitable term here? Thumbs up for open sourcing your work, though.

Really disappointing to see someone's work get trashed. Rock on for open sourcing it.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#86
post #54

Thanks for sharing! I wished more people would share code of projects they are no longer interested in. The educational value ('how did he/she built this') is worth a lot, regardless of the 'quality' of the code. Thank you!

i've been trying to put unused stuff on my github https://github.com/th0ma5w and i've received great comments, and people thanking me for showing general concepts and such, so that's been really great to hear, especially from crap i just had sitting around at dead ends.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#87

Earlier quoted context omitted.

Your very first comment on HN got a down-vote, I haven't actually seen a -5 karma before. On the bright side you've nowhere to go but up. Seriously though I agree with your point about PDO. Perhaps the down-vote was due to the comment about de-engineering and apparently making fun of 10k LOC? I took a look at the app and it's got a huge amount of features. 10k is not really that much code for a "enterprise" app I sup…

It was the first metric that came to mind, it was hard to describe in time since development was on and off for a while. I just wanted people to know it wasn't a small project.

It actually looks like a nice product. I can tell from your video that you feel about the same way I do of many of my projects. Even after a few months it's hard for me to look at my work and not see the flaws and missing features. But it's good to keep in mind that people who aren't building the app don't usually see those things.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#89

Earlier quoted context omitted.

I'm not the OP but almost any PHP project these days has me reaching for Symfony 2[0] or her little brother Silex[1] paired with Doctrine 2[2]. [0]. http://symfony.com/ [1]. http://silex.sensiolabs.org/ [2]. http://www.doctrine-project.org/

Symfony is nice, Zend 2 is going to fix everything from ZF1 and is worth keeping an eye on as well. I've dabbled in Doctrine before, but the memory usage looked a little too high for the convenience it offered.

Yes with some complicated work patterns, Doctrine becomes memory and cpu/time hungry. I've been struggling with doctrine issues with our customers event portal. Most of the time we have to turn back into array based hydration. Even then time/cpu intensiveness is still there.

Re: Just open sourced my 10k LOC PHP & MySQL invoicing app

#90
Okay, so coming from a user of CI 2.0 mind you and using integrated smarty templates with it, I would have to say after using even a micro-framework say silex, I could build a much better enterprise application with modern php5.3/5 features than i can with CI. The major problem is it feels really dirty to include/require statements with CI. Also to build re-usable code within the confines of their existing library system you have to build all your constructors with a single $param argument. The models are junk since they are really just a place to store organized function calls. Their database abstraction is an abomination. Generally the only thing good about CI is that you can break up your source into a marginally logical fashion which can it improves maintainability.

Now as for this application being written in Code Igniter? I don't really see it as a problem since it means it will be easier for lesser experienced dev to pick up and run with the ball. In time they will learn it's major deficiencies and they will move on. But i think there is room for improvement, in fact I think this would be a great project to port to another maybe more robust framework and is a good project for learning new framework translations.

I will say however that the author wanting to rewrite a product like this in nodejs is really only going to make something like this more inherently difficult to maintain since javascript code tends to get more complicated than your typical java / php / python app as it grows. Granted you do have js at your finger tips it is still largely un-tested on massive scale for large application development. It however has shown great promise for handling extreme traffic in terms of concurrency, but it handles it mostly by using async libraries which pile everything into queues of some sort some where. So your code is littered with async callbacks everywhere. Anyways.. Not only that, but the biggest problem of all is the inability to intelligently step through your code with some kind of IDE beyond using a browser-base debuger such as webkit inspector or the online IDE cloud 9.

I don't hate nodejs. I just think people are jumping on the band wagon way too quickly for server-side hosting. For websockets it's a great solution, I just don't like seeing it as "the only solution" for some peoples projects. I'd rather see a more hybrid approach.

Post reply on HN