Efficiency and good practice

kaiyatamaya

I'm looking for some advice on how to approach the redevelopment of my site. It's a custom made membership system that currently works as intended, although as it was developed over a year and a half, during which time I obviously learned a bit 😉 it ranges from inefficient to half-decent.

I'm now in the process of reworking the entire system, recreating it from scratch as it really is a bit of a bombsite code-wise!

.php or .html or even .shtml? the site is a mix of static info pages and dynamic select pages. Currently every page is a php page with all html in echos (lovely I know) and the html head and foot of the page in a included php file for ease of editing. The html head and foot are identical on every page, the php scripts on every page are unique and custom. The static info pages currently have no php on them - they are written as html in php (bad kaiya slaps).

My plan was to take the static pages and add them to a page table, with one php page accessing that table for the pages. As I'm not sure about the security risks with eval() I think I can only do that with static pages, not with dynamic pages. So the plan for dynamic pages was to keep them as they are - .php.

From what I've read here, .php pages with html in echoes is poor design. What's the best way to deal with html within php? Have .html files with internal php (in which case, does the page.html?page_id=$var method of linking work?) or have .php files with the html as variables calling from another table?

My second efficiency/design question is is this:

$sql = mysql_query("SELECT * FROM table WHERE field = '1' limit 1");
$numrows=mysql_num_rows($sql);

while ($row = mysql_fetch_array($sql))
{

	foreach( $row AS $key => $val )
	{
		$$key = stripslashes( $val );
	}
echo "$variable $variable2 etc";
	}

considered acceptable? I used to use mysql_fetch_row but as almost every query has 1-2 left joins it became very difficult to modify many php pages when I changed a table.

Thanks!

bpat1434

Well, echoing HTML isn't terrible. I do it in plenty of code. What matters is that you have a standard, and you stick to it. So if you like to echo HTML, echo HTML. If you want to use HEREDOC syntax, use that. But stick with 1 standard.

As for having .html pages that act as .php pages: NOOOOO!!
HTML pages are meant to be static, php pages are meant to be dynamic. The second you change a .html page to a dynamic page in which the server must work to parse each document, you essentially destroy what it is there to do (in my opinion). Leave html as html, and php as php.

As for getting contents of HTML with embedded PHP, there is no security flaw, unless you don't secure your code. Same goes for SQL injection. Your code is as secure as you make it. If you want to make it air/water/gamma-ray tight, do it. If you want it all loosy-goosey, whatever. It's up to you.

Regarding the mySQL query question: Why use a while() loop when accessing only one row? Just use $row = mysql_fetch_assoc($result). You don't need a while() loop unless you're accessing multiple rows (which the query you show limits the results to 1 row).

I would say that if you have any static pages that have PHP in them, get rid of them (unless you're using a templating system), it'll be easier on the server. While the strain is miniscule, many requests at once could start to make a difference on performance.

~Brett

madwormer2

Dude, gamma radiation goes through a lot.

You'd have to have several feet of concrete in your code, and I think that's just inefficient. Use lead.

Erm... yeh.

bpat1434

Lol... it was an expression. Funny though....

So Superman had a vision on the level of Gamma rays.... but then how did he control it to be able to see LAYERS?!?!

If I look int my computer at a website, and I used my Gamma-ray vision, would I be able to see the working code....?

Lol... I'm a dork...

~Brett

kaiyatamaya

Thanks! My query example was a bad example - most are not limited to 1. However I was using while() for the ones that were limited to 1 as well so that's worth knowing!

The only reason I'm worried about the security flaws is that I don't understand the risks I'm trying to avoid and so don't know if I have successfully avoided them. The site's been in operation for over a year now with my probably dodgy forms without suitable anti-php checks etc and hasn't had a problem. I'll do what I can to tighten it and try to backup frequently 😉

Thanks for your help!