What do computer science engineers do?

[pbuk]

That's what I think I'm doing.

Yes, it looks like it.

I tried the PHP recommended way of just calling "session_start()" at the start of each page, but that didn't seem to work,

session_start must be called before any output is sent. It seems like you are unintentionally sending multiple byte order marks (and should not be sending any - they are invalid in XHTML and unnecessary in plain HTML) as well as comment tags before the DOCTYPE declaration.

Do yourself a favour and switch to HTML 5.

so now I'm handling the session manually.

Are you sure - I can still see that PHPSESSID cookie?

I still need to encrypt stuff

What stuff do you need to encrypt?

and use htmlspecialchars correctly.

Use a template engine like Twigg to avoid unescaped HTML.

I'm probably open for an SQL injection attack.

Use PDO prepared statements (or a database abstraction library like ADODb) to avoid this.

So if you have any more papers I'd love if you provide me with links.

No papers needed, this stuff is just PHP 101.

 

[sbrothy]

Yeah, I'm new to PHP. I've used Perl before but mostly Apache (or Tomcat) and WebSphere App Server with Java. And C# and the whole Windows methodology. I appreciate your (relentless ) advice.

EDIT: I meant JSP and JavaBeans.

 

[sbrothy]

What I want to encrypt are the users passwords when I get registration going. BTW, you can't judge from my GIT link. It's hopelessly outdated. But yeah, I'm a noob here. Again I appreciate your input. No matter how hard the tone. I just have to swallow my pride.

EDIT: Oh sorry. I already said that about the version control.

 

[sbrothy]

i work on a project where i build a app for my gymnasium in our college and my role is frontend dev and i have a teammate. we do code in flutter. sometimes i have some important classes and i will go to attend it in that time he will push something in my branch and call it a update. he will change so many files like i am hit with almost 100 of merge confict. by that i can confirm it is not fun working with someone. but the ui part it still fun working with ui. you just draw and design no complications unlike the backend engineer who will freak out how how they conna worute logic how they gonna design table.

He/She should at least check files in with informational comments and leave comments in the code. If he/she doen't it's bad discipline.

 

[pbuk]

What I want to encrypt are the users passwords when I get registration going.

Passwords should be hashed rather than encrypted. Use password_hash with the default bcrypt and automatic random salt but consider increasing the cost option.

BTW, you can't judge from my GIT link. It's hopelessly outdated.

I haven't looked at your GIT link, I am just inspecting your http responses.

 

[sbrothy]

I figured as much. As I've already said I appreciate your input and the time you use putting me on the right course!

EDIT:

 

[sbrothy]

I'm sure you'll, if not exactly appreciate, then at least see good reason why I'm starting over implenting a proper MVC framework. And it's all your fault!

Nah, it was truly getting a mess. So it'll be down for some time now.

 

[sbrothy]

Passwords should be hashed rather than encrypted. Use password_hash with the default bcrypt and automatic random salt but consider increasing the cost option.



I haven't looked at your GIT link, I am just inspecting your http responses.

Shouldn't they also be "salted"? I seem to remeber something to that effect....

EDIT And you already mentioned that. I need a pair of glasses.

 

[sbrothy]

Yes, it looks like it.



session_start must be called before any output is sent. It seems like you are unintentionally sending multiple byte order marks (and should not be sending any - they are invalid in XHTML and unnecessary in plain HTML) as well as comment tags before the DOCTYPE declaration.

Do yourself a favour and switch to HTML 5.



Are you sure - I can still see that PHPSESSID cookie?



What stuff do you need to encrypt?



Use a template engine like Twigg to avoid unescaped HTML.



Use PDO prepared statements (or a database abstraction library like ADODb) to avoid this.



No papers needed, this stuff is just PHP 101.

It turned out the silliest thing I was doing was to try to serialize XML (storing it in the supergobal $_SESSION with no clue as to why this wouldn't work). I solved that and after getting hit over my fingers with a sliderule by you I finally got so mad (at myself) that I actually sat down and read the fine manual, getting a better understanding of session persistence. So that seems to work now (I think I managed to rename the PHPSESSID, but the name I chose is pretty transparent. You'll probably not be fooled. I'm using cookies now.

I am already using prepared statements but I properly overdesigned the (small) database because I was having fun nerding around with it. I'll clean it up in time.

I still have to heed your words about my HTML version and DOCTYPE, and take your other critique to heart. Just wanted you to know it wasn't a complete waste of time on your part.

You remind me a little of Vanadium50 (may he rest in piece, whereever he is) in that you also don't suffer fools gladly. I'm glad you suffered me a little though. I'm a glutton for punishment!

EDIT: Oh, I stupidly answered my own post, or did I? It's late here. 01:30. Typical scatterbrained me. I'll just leave your name @pbuk here so I know you'll see it.