I am interviewing for a position which has come up in my company next week and I need to come up with some coding questions to evaluate the candidates.
I thought about coming up with a few questions to ask during the interview but then thought it might be better to come up with a short script with some problems to find, and give each candidate 10-15 minutes to look through it so as not to feel too much on the spot. What do you guys think of this approach? It does seem a bit rigid, maybe an informal discussion about coding techniques would be better.
Anyway, here is the script. There are about 8-9 flaws and security issues to find. I don't expect people to find them all. Answers to come 
The URL to the script: http://www.mysite.com/index.php?page=userdetail&id=1
Some php.ini settings:
display_errors On
allow_url_fopen On
allow_url_include On
File index.php
<?php
// Load header, footer and page content
require 'header.html';
require $_GET['page'] . '.php';
require 'footer.html';
?>
File userdetail.php
<?php
// Select users credit card information from the database
$sql = 'SELECT * FROM the_table WHERE id = ' . $_GET['id'];
$connection = mysql_connect( 'db_uri', 'username', 'password' );
mysql_select_db( 'the_db', $connection );
$resource = mysql_query( $sql );
$row = mysql_fetch_assoc( $resource );
// Display the page
foreach( $row as $key => $value )
{
echo 'Card number: ' . $row['cardnum'] . '<br>';
echo 'Start date: ' . $row['startdate'] . '<br>';
echo 'End date: ' . $row['enddate'] . '<br>';
echo 'Security code: ' . $row['seccode'];
}
?>
This is just sample code, it obviously won't run so assume it parses and any credentials are correct.
I would love to know other peoples experience from the "other" side of the table. I've only ever been a candidate and never an interviewer. It's suprisingly nerve racking.
-Paul
