my first proper php cms

ashley98860615

Nothing fantastic about my code but it's my first real attempt at a php based website. Everything works (well should do) but i have more features to add in the future.

Basically it's a phpnuke like web cms. It is organised as:

menus - navigation etc
pages - actual pages
includes - includes!
themes - looks
library - reusable things
admin - adminstration area

suggestions etc are very welcome. online demo: www.treble.lfhost.com/1024/ (being updated reguarly so if the db seems to be incorrect thats why)

Thanks

planetsim

This is a code critique not script test and critique.

Firstly no readme file? How do i install it.
Secondly I suggest removing db info from config.php
Lastly wheres the SQL?

planetsim

Just went to the Demo
- I suggest downloading the Leak Monitor (extension) for Firefox. There is a leak in Javascript (dbx.js)
- Sanitize your user data Query Strings and forms. I have taken a look at the code yet but it seems your coding with the mindset that magic_quote_gpc is always going to be on. PM for a specific test.

ashley98860615

sorry i forgot about the sql, i've attached it to this post now. I tried creating a install script but ran into error with executing the SQL (i'm seeking help for that now). I'll look more into creating an install script.

Where should i move the db from config to? And why?
Also i don't understand what you mean by your second point in the second post..?

The dbx is a third party script by Brothercake and i have contacted them asking for help in regard to the issues with IE.

Thanks for looking - i've updated the test site now.

planetsim

You left your database name, username and password in the config script. My second point is if magic_quotes_gpc was not on you could successfully perform an SQL Injection on any script. By default magic_quote_gpc will add a slash on to ' and " . Without it the slash wouldnt work. I suggest reading up on what an SQL Injection is.

[edit]
Small idea do leave your records in the SQL, unless they are needed.
[/edit]

ashley98860615

ok thanks i will