So lately i've been building a simple forum software called RizoBB so i've finally got pretty much done with it and thought i'd post it for download incase people wanted to learn how to build there own or just use it for there site or whatever please leave the copyright in place though Ok so to install it just create a new darabase and import the forum.sql dump file which will build the tables.

 

 

I've already got one admin on there for you so you wont have to register to get to your admin Cp heres the admin info.

 

 

Username== admin

Password == admin123

 

Well anyways i hope you enjoy my work and can learn from it

forum.zip

So lately i've been building a simple forum software called RizoBB so i've finally got pretty much done with it and thought i'd post it for download incase people wanted to learn how to build there own or just use it for there site or whatever please leave the copyright in place though Ok so to install it just create a new darabase and import the forum.sql dump file which will build the tables.

 

 

I've already got one admin on there for you so you wont have to register to get to your admin Cp heres the admin info.

 

 

Username== admin

Password == admin123

 

Well anyways i hope you enjoy my work and can learn from it

 

 

As much as i hate to be bitchy i suggest people do not attempt to learn from this. This would be a arsey post if i didn't include constructive critisism so here it is:

 

• Theres no need to use addslashes on data which has already been passed through mysql_real_escape_string.
  
• Strings should be enclosed in quotes, not like this:
  

  mysql_connect(localhost,root,'') 
  

  
  

• Cookie data is user data, therefore it must be escaped too.
  
• You must check if a superglobal is set before using it (otherwise you're going hammering error_log with useless errors)
  
• Don't use SELECT *, specify the fields you require.
  
• Any data being put into a form such as <img src="<?php echo $_POST['your_image']; ?>" /> must be escaped using a function such as htmlspecialchars with ENT_QUOTES enabled.
  
• There is no validation against cookies (you've got "remeber me" functionality) - so i could edit my $_COOKIE['uid'] to be true or 1 (which is usually an administrator) and log directly in using their account. If you're going to have remeber me functionality generate a key for each user and check it, ALWAYS.
  
• When writing SQL queries stick to the general rules.. Numeric data should not be enclosed in quotes.
  
• Refers to above - All id's should really be cast to integers using intval or (int)$var
  

 

Just a quick summary i made from opening a few files - I think it's great you've coded this to help people, however sometimes things can inadvertently teach people wrongly.

 

Sorry!

Thanks for the advice above i guess for time purposes i cut alot of corners that should not have been cut when building a script for someone to learn from. But anyways im currently working on a more accurate version of RizoBB so anyone who downloads the one above it still might teach you something but like he mentioned somethings in the script arnt the right way to do stuff i'll post the updated script once finished it will consit of more features also such as the private messenger and easy to edit template files and language packs but anyways peace out for now and thanks again