Member Avatar for UI

Programming Buddies,

Looking at the following links, can you be kind enough to tell me which one I should learn from and which one teaches what method (mysqli, pdo, etc.) and whether they are on php 7 or 5 because only looking for php 7:


https://www.codeproject.com/articles/759094/step-by-step-php-tutorials-for-beginners-creating

And, is this a good way to prevent sql injection ? It is unorthodox, I guess:

https://blogs.msdn.microsoft.com/brian_swan/2010/03/04/whats-the-right-way-to-prevent-sql-injection-in-php-scripts/

Edited by Reverend Jim because: Removed BBS tags
  • 3 Contributors
  • 3 Replies
  • 352 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by UI

Dani AI

Generated

asked for PHP7-compatible guidance; suggested the first link and pointed to the usual “Bobby Tables” warning. For a member registration/login system in 2025 (and to be safe on PHP 7+), pick a tutorial that meets these concrete checks: it uses PDO or MySQLi with prepared statements, and it uses PHP’s password_hash()/password_verify() for passwords. The old ext/mysql API was removed in PHP 7, so any tutorial that uses mysql_connect() / mysql_query() will not run on PHP 7+. (php.net)

Prepared (parameterized) statements are the standard, reliable defense against SQL injection — use PDO or MySQLi prepared statements for every query that includes user data. Also never store raw or weakly hashed passwords; use password_hash() and password_verify() so the hashing algorithm and cost are handled correctly. These are the consensus best practices from security authorities and the PHP docs. (cheatsheetseries.owasp.org)

A minimal, safe pattern to look for in a tutorial (and a quick copy/paste starter) is below. It shows the core ideas: prepared queries + secure password hashing.

/* register */
$hash = password_hash($_POST['password'], PASSWORD_DEFAULT);
$stmt = $pdo->prepare("INSERT INTO users (email, password) VALUES (:email, :pw)");
$stmt->execute([':email'=>$_POST['email'], ':pw'=>$hash]);

/* login */
$stmt = $pdo->prepare("SELECT id, password FROM users WHERE email = :email");
$stmt->execute([':email'=>$_POST['email']]);
$user = $stmt->fetch();
if ($user && password_verify($_POST['password'], $user['password'])) {
  // authenticated
}

Quick checklist for vetting a tutorial: search its code for PDO or mysqli and ->prepare / prepare(; search for password_hash / password_verify. If you find mysql_ functions, addslashes() as the main defense, or md5() for passwords, treat it as outdated. If a tutorial is older (pre-2015) it may teach legacy patterns — the concepts can still help, but do not copy the DB or hashing code without updating it to use prepared statements and password_hash(). (php.net)

Summary: prefer a tutorial that shows PDO or MySQLi prepared statements and password hashing. Use the short checks above before following its code.

Recommended Answers

All 3 Replies

Member Avatar for Robert_40

The 1st one

Member Avatar for UI

Thank you everyone!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.