1. Primary awareness: security
Most of the time, the web programs we develop need to deal with databases, so it can almost be said that SQL injection is an issue that cannot be avoided and needs to be discussed. And in recent years, attacks like XSS and CSRF have become popular, giving "hackers" seemingly a new set of weapons, while we are always in a passive state. But we must remember the following two principles:
1. Never trust what the user inputs. (It’s an old saying, but it’s true)
2. Escape the data you need to output.
To put it simply: filter in put, escape output
If you are a newbie, do not use query statements similar to the following:
SELECT FROM users WHERE username = $_POST['username'] AND password = $_POST['password'];
Another thing is, use PDO or Mysqli instead of using old-fashioned mysql operations.
As for the CSRF solution, the current solution is to set a token value for each form submission, and then verify it when the form is submitted.
2. Clearly know the differences between comparison operators
PHP comparison operator, this can actually be said to be a small attention point, but it is really important at certain times. For example, many times we have to think clearly about whether to use == or ===. If you have used the strpos() function, the following code may give you an intuitive feeling:
The running result of the above code actually outputs that Chris is not an author, but the reality is that Chris & Sean are really Authors. Why is this so? In fact, it is like this: Chris happens to appear in Chris & Sean The beginning of the first position is the position of 0, so substr() returns. Due to the bool judgment in the conditional judgment statement, 0 is treated as false, so the program outputs that Chris is not an author, but in this case we How to deal with it? We can actually do this:
The difference between !== and != here is reflected.
3. If you can reduce the use of else, use less else
This seems to be an idea that I have had since I first came into contact with programming, because every time I see if(){}else{}, I have a feeling that this paragraph can actually be written better, because once you reduce the use With the else keyword, your code will be reduced by two lines! Yes, two lines is also our pursuit, and from my experience, code with less else seems to be more readable, to me.
if( this condition ) { $x = 5; } else{ $x = 10;}
If the default value of $x is 10, it would be better to write it like this:
$x = 10;
if( this condition )
{ $x = 5; }
4. Remove unnecessary brackets
The purpose here is actually the same as the else keyword part. We are for shorter code and better readability. You should consider optimizing the code in the following situations:
if ($gollum == 'halfling') { $height --; }
Actually it can be like this:
if ($gollum == 'halfling') $height --;
You can even do this:
Do you have a short and clear feeling?
5. Use str_replace() frequently
In many cases we need to replace some strings. There are several functions in PHP that can achieve this purpose:
str_replace()
ereg_replace()
preg_replace()
If you really need to use regular matching, then use preg_replace(), and if replacement is possible, please use str_replace(), because according to incomplete statistics, the efficiency of str_replace() is among the three It is the highest among them.
6. Use the ternary operator
Many people may have this feeling. After using the ternary operator, we can remove a bunch of if else statements, and the code is short and cool.
$host = strlen($host) > 0 ? $host : htmlentities($host);
7. Use cache
At present, the most popular caching technologies in PHP may be Redis and Memcached. In the official PHP documentation, there are also tutorials on the use of Memcached. As for Redis, I am currently researching it and will give some tutorials in the future, if everything goes well.
8. Use frameworks
There are many benefits of frameworks. Apart from the possible loss in performance, it seems that there is no reason not to use frameworks. Frameworks can speed up your development and make you feel comfortable while writing code. It's comfortable, and you will get good solutions to many safety issues. My first recommendation here is Laravel, but frameworks like Yii2 Slim and Symfony are very good. Except for Symfony, which I have never tried, I have experience in using the remaining three. In the end, I basically used Laravel. However, the Laravel I recommend may not be suitable for you, it still depends on personal preference.
9. Use isset() instead of strlen()
If you need to make a conditional judgment based on the length of a string in the project code, it is highly recommended that you use isset() directly at this time, because under the same conditions, isset() is five times faster than strlen() About times, so:
The above two conditional judgments can achieve the same purpose, but I recommend using the first one.
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
