php-clean-blog's Introduction

php-clean-blog

Clean Blog from Start Bootstrap implemented with PHP.

Quickstart

Clone the repo

$ git clone [email protected]:cfc603/php-clean-blog.git
$ cd php-clean-blog/

Set DB_USER and DB_PASS to your MySQL username and password

$ nano private/db_credentials.php

Create MySQL database and test data

$ mysql -u <username> -p < database/create.sql
Enter password: <password>

Run local server

$ cd public/
$ php -S localhost:8000

Not Production Ready

There are several issues which should be addressed before deploying to a production environment.

php-clean-blog's People

Contributors

Watchers

php-clean-blog's Issues

Escape Blog Post body

Currently all data from the database is escaped using PHPs htmlspecialchars function with the exception to Post.body in the following view:

// public/posts/view.php

...
<!-- Post Content -->
<article>
  <div class="container">
    <div class="row">
      <div class="col-lg-8 col-md-10 mx-auto">
        <?php echo $post["body"]; ?>
      </div>
    </div>
  </div>
</article>
...

As formatting in the post body is using html characters, we need another solution for formatting or preventing XSS attacks.

Need Create, Update & Delete Views

public/posts offers a way to view posts but no views for creating, updating or deleting posts. Query functions have been created in private/query_functions.php :

// Create Post
create_post($record) # takes associate array as argument

// Update Post
update_post($record) # takes associate array as argument

// Delete Post
delete_post($id)