Thread: Comment class
View Single Post
Old 08-16-2006, 10:13 AM   PM User | #2
d11wtq
Regular Coder

 
Join Date: Dec 2004
Location: Manchester, UK
Posts: 134
Thanks: 0
Thanked 0 Times in 0 Posts
d11wtq is an unknown quantity at this point
I'll try to provide some constructive criticism

I'd probably break the markup out into a template file... placing that amount of markup in a class is generally not a good idea since you need to edit the class in order to change the layout slightly.

$_SERVER['PHP_SELF'] is tainted and can be exploited. In fact, many of the $_SERVER superglobals are tainted. Do you actually need the 'action' attribute in there at all or can you maybe have the user specify where it should point to?

EDIT | Yikes. Don't do this:
PHP Code:
$this->SQL "INSERT INTO `".$this->table."`('columnid', 'name', 'comment', 'commentid', 'time', 'email', 'ip') VALUES (`".$this->column_id."`, `".$this->name."`, `".$this->comment."`, `".$this->commentid."`, NOW(), `".$this->email."`, `".$this->ip."`) LIMIT 1"
Be sure to mysql_real_escape_string() on those value which have come straight from $_POST.
d11wtq is offline   Reply With Quote