Don't use require, require_once, include or include_once
Almost all developers, use this way to handle external files. Your script should be including various files on top, like class libraries, files for utility and helper functions, etc like this :require_once('inclides/Configure.php');
require_once('inclides/Database.php');
require_once('class/general_functions.php');
This is rather primitive. So that, you need to do this in a different way and the code needs to be more flexible. Write up helper functions to include things more easily. Let's take an example :
function include_class($class_name)
{
//path to the class file
$path = ROOT . '/include/' . $class_name . '.php');
if(file_exists($path)) {
require_once( $path );
}
}
include_class('Configure');
include_class('Database');
There are a lot of things that can be done with this.
Create a class for repeated tasks
Object-oriented programming is a powerful programming style for the flex coding and less work for a huge task as well as for the repeated task. Object-oriented programming is considered to be more advanced and efficient than the procedural style of programming. Object-oriented programming has several advantages over the conventional or procedural style of programming. Classes and objects are the two main aspects of object-oriented programming.class Rectangle
{
// Declare properties
public $length = 0;
public $width = 0;
// Method to get the perimeter
public function getPerimeter(){
return (2 * ($this->length + $this->width));
}
// Method to get the area
public function getArea(){
return ($this->length * $this->width);
}
}
Once a class has been defined, then create another PHP file to get access of this class with the object:
require "Rectangle.php"; // Include class definition
$obj_rec = new Rectangle; // Create a new object from Rectangle class
$obj->length = 30; // Set object properties values
$obj->width = 20; // Set object properties values
// Read the object properties values again to show the change
echo $obj->length; // 0utput: 30
echo $obj->width; // 0utput: 20
// Call the object methods
echo $obj->getPerimeter(); // 0utput: 100
echo $obj->getArea(); // Output: 600
Make your functions flexible
Whenever adding a single item in session or any other object, you use the above function. When adding multiple items, will you create another function? So Just make the function flexible enough to take different kinds of parameters. Let's take an example:function add_gift($item_id , $qty)
{
$_SESSION['gift'][$item_id] = $qty;
}
add_gift( 'Phone' , 1 );
Above function used for the single gift add, now looks the example for single and more than one parameter:
function add_gift($item_id , $qty)
{
if(!is_array($item_id))
{
$_SESSION['gift'][$item_id] = $qty;
}
else
{
foreach($item_id as $i_id => $qty)
{
$_SESSION['gift'][$i_id] = $qty;
}
}
}
add_gift( 'Phone' , 1 );
add_gift( array('Laptop' => 1 , 'Pen' => 2) );
Always correct character encoding for a MySQL connection
This is a big problem for beginners, ever faced a problem that Unicode/UTF-8 characters are stored in MySQL table correctly, PHP my admin also shows them correct, but when you fetch them and echo on your page they do not show up correctly. The secret is a MySQL connection collation.$host = 'localhost';
$username = 'root';
$password = 'password';
//Attempt to connect to database
$con = mysqli_connect($host , $username, $password);
//Check connection validity
if (!$con)
{
die ("Could not connect to the database host: ". mysqli_connect_error());
}
//Set the character set of the connection
if(!mysqli_set_charset ( $con , 'UTF8' ))
{
die('mysqli_set_charset() failed');
}
Once you connect to the database, it's a good idea to set the connections characters. This is a must when you are working with multiple languages in your application.
Use of Prepared Statements for SQL injection attack
Always Use of Prepared Statements for SQL injection attacks instead of the normal SQL query. The first step in preventing a SQL injection attack is to establish which (if any) of your applications are vulnerable.You need to implement prepared statements with Parameterized Queries. Let's take an example:
$cid = $_GET['cid'];
$get_prepare_query = db_prepare_query("select * from ".TABLE_CATEGORIES." where category_id = ?");
$get_prepare_query->bind_param('s', $cid);
$get_category_prepare_result = db_prepare_result($get_prepare_query);
$get_category_result = array_shift($get_category_prepare_result);
if(sizeof($get_category_result) == 0 ) tep_redirect(tep_create_url(''));
$category_id = $get_category_result['category_id'];