10 Common Mistakes for PHP Developers to Avoid

Single Quotes, Double Quotes

The advantage of concatenating strings with double quotes is that everything is parsed neatly, so you don’t have to worry about escaping characters or using dot values. However, using single quotes has significant performance benefits, since the additional processing is relatively small.

# $howdy = ‘everyone’; 

# $foo = ‘hello $howdy’; 

# $bar = “hello $howdy”;

Semicolon After A While

Everything has a huge impact in coding hence, even little semicolons or while statements can cause havoc in a program, but they won’t even appear in PHP error logs. Fortunately, Codeutopia provides a representative example of this little error, demonstrating that these nasty errors don’t even get reported (even to E_ALL! ), as they quietly enter a loop. Simply omit the final; after the while statement, and your code is good to go.

$i = 0;

while($i < 20); {

  //some code here

  $i++;

}

Not Using Database Caching

It is strongly recommended to use some form of database caching in PHP script. Memcached has emerged as the most popular caching system, with mammoth websites like Facebook recommending it.

For PHP in production, the caching system, Memcached, is strongly recommended. It is free and can provide significant performance gains if used correctly.

Missing Semicolon Either After Break or Continue

Similarly to #2, you might not be able to track down a misused semicolon while it slips into the shadows. You can prevent this by using braces with PHP control structures (via CodeUtopia) if you’re using a semicolon after a “break” or “continue” in your code. This might force you to scratch your head.

Not Using E_ALL Reporting

You should definitely take advantage of PHP’s error reporting functionality, especially if you are not already using it. Error reporting saves a lot of time when debugging code, and speeds it up as well. 

Some PHP programmers use error reporting, but not all of them use it properly. E_ALL is a very strict type of error reporting, in which you ensure that every single error is reported. (That’s essential if you want to write great code.)

Turn off reporting options when done with programming or development, so that users won’t see a bunch of error messages on pages that otherwise appear fine.

Not Setting Time Limits on PHP Scripts

It’s often assumed that PHP scripts will finish in a timely manner when running. However, every good programmer knows that assumptions can lead to a program’s inefficiency. It’s hard to write a program that’s responsive when scripts do not run. 

A simple fix for this is to set a time limit on the script (set_time_limit). While it may seem trivial, it’s always smart to be prepared.

Not Protecting Session IDs

The most common PHP security mistake is not encrypting session IDs. Not encrypting session IDs is almost as dangerous as giving away usernames and passwords. A hacker could gain access to sensitive information by taking the session IDs. By adding sha1 to $userpass, you add an extra layer of security to the session. Sha1 isn’t a 100% effective method, but it gives users a nice layer of protection against malicious users.

MT Soft is an example of how to protect Session ID with sha1:

if ($_SESSION[‘SHA-256password’] == SHA-256($userpass)) { // do sensitive things here

}

Not Validating Cookie Data

Most people give cookies their complete trust without thinking twice about the seemingly harmless data they pass along to sites. The word “cookie” itself goes hand-in-hand with milk, nap time, and Santa Claus, for crying out loud. How could something so seemingly meaningless possibly be so harmful? The fact that cookie data is not validated before storing it in a database can expose your code to potentially harmful data. To validate a cookie, use htmlspecialchars() or mysql_real_escape_string().

Not Escaping Entities

It is imperative to sanitize all data before it is stored in any type of storage, including a database. PHP programmers generally trust data more than it is required, especially data generated by users.

In Source Rally, we learn how to escape entities correctly in things like forms. You can validate the data by using htmlentities() (or htmlspecialchars()) as follows:

Instead of using: – 

echo $_GET[‘username’];

validate data with: – 

echo htmlspecialchars($_GET[‘username’], ENT_QUOTES);

Using Wrong Comparison Operators

PHP programming involves comparison operators, but combining them in the same code is certain to break your code. As a German proverb says, the devil seems to be in the details. It is absolutely critical to be familiar with the syntax of often-misused operators like =, ==, !=, so you can speed up your programming and find fewer bugs.

Final Note

PHP is still a great choice for web development or mobile development. Businesses across the globe chose PHP to obtain robust software solutions even though there are many false rumors that PHP can no longer provide desired outcomes. However, the usage statistics straight away prove all the negative statements about PHP wrong.

In fact, there are many people or newbies who wish to start their career in PHP as there is a high scope. If you’re a PHP programmer or wish to learn PHP in the future, then keep in mind the above-mentioned 10 common mistakes PHP developers must avoid.