Despite the high expectations placed on them at times, developers are human. They were the last time we checked anyways.
As humans, we are bound to make mistakes from time to time. And simple, common mistakes often slip past our filters the more comfortable we become with something.
Think about it, when you first started writing code you most likely checked every line to make sure things were perfect. As you grow more comfortable with the process, little things often get overlooked and mistakes are made.
But knowing what these common mistakes are and how to avoid them can really help speed up the development process and keep our clients smiling.
Below you will see some of the more common mistakes that are made with PHP, even by advanced developers…
Poor Housekeeping
People can get lazy and code can get messy.
To keep it organized you can use things like comments and indents. I know, these are basic best practices but think to yourself, when was the last time you hacked up your code without commenting?
I thought so.
How about breaking your code into modules based on function? Many agree that as a rule of thumb your function should not exceed one page on your screen unless it is necessary.
Another good housekeeping practice is to backup all of your files before you upload changes. Sure you may be in a hurry, but the time it takes to make a quick backup is far less than having to go back and undo a disaster.
Forgetting Your Punctuation
One of the best things about PHP is that you don’t need expensive software to write code in. Any text editor will do.
Unfortunately, a basic text editor won’t tell you if something isn’t right.
One of the most common, and basic, mistakes made when coding in PHP is to either forget or misplace a quote, brace or semi-colon causing a syntax error. Before you try to run anything, make sure that every:
- [ has a ]
- ( has a )
- { has a }
Now check to make sure that all string keys are enclosed with matching quotes. Remember, “ does not match with ‘.
While you are at it, double check the semi-colons to make sure they aren’t missing or misplaced.
Forgetting to Validate Input
By now you should know that user provided data cannot be trusted. Allowing this from your users is one way that cross-site scripting, buffer overflows and injection flaws can all be used to attack your site. Unfortunately, it is also one of the most common mistakes people make when coding in PHP.
In the following lines of code, notice that the three variables are not validated:
$birthdate = $_GET['birthdate']; <br>
$birthmonth = $_GET['birthmonth']; <br>
$birthyear = $_GET['birthyear']; <br>By adding the following lines of code we use preg_match to perform a regular expression match against the input. In our birthdate and birthmonth variables it is checking to verify that a one or two digit number between zero and nine was entered. For birthyear, it needs to be a four digit number between zero and nine:
if (!preg_match("/^[0-9]{1,2}$/", $birthdate)) die("That is not a valid date, please check that again."); <br>
if (!preg_match("/^[0-9]{1,2}$/", $birthmonth)) die("That is not a valid month, please check that again."); <br>
if (!preg_match("/^[0-9]{4}$/", $birthyear)) die("That is not a valid year, please check that again."); <br>We are able to make sure that the proper type of characters are input by the users are actually numerals and only numerals that we expect to be entered. Anything else results in an error being thrown back to the user.
So I call on our readers to share with us some of the most simple mistakes we have made over the years. And don’t worry, we’re all human here.
