haroldnicky
Here is a list of my improvements to integrate, each with a short explanation :
  1. Reorganize the project following MVC (or a clean structure)
o Why? Separating responsibilities (Controllers, Models, Views) makes the code more readable and maintainable.
  1. Refactor controllers
o Why? Splitting large methods into smaller private methods and avoiding deep if nesting improves clarity and testability.
  1. Use a dedicated router (AltoRouter, FastRoute, etc.)
o Why? Avoid manually handling $_GET; a routing library streamlines route definitions and maintenance.
  1. Adopt PSR-4 for autoloading & PSR-12 for coding style
o Why? Adhering to standards ensures consistent structure, better teamwork, and easier integration with tools (linters, IDEs).
  1. Centralize configuration
o Why? Keep logic and parameters (DB credentials, API keys, etc.) separate; simplifies environment management (dev/staging/production) and boosts security.
  1. Separate frontend assets in a public/ folder
o Why? Clearly isolate CSS, JS, media, and prevent direct access to sensitive code outside the public directory.
  1. Validate and escape all user inputs
o Why? Prevent XSS and SQL injection attacks.
o How? Use prepared statements (PDO) for queries, htmlspecialchars() for output, and a centralized validation library (Valitron, Respect\Validation, etc.).
  1. Implement CSRF protection
o Why? Block malicious attempts to make a user perform unwanted actions (Cross-Site Request Forgery).
o How? Generate a session-based token, add it to forms, and verify on submission.
  1. Control or sanitize redirects
o Why? Avoid Open Redirect vulnerabilities by only allowing safe, expected URLs.
  1. Optimize database queries
o Why? Improve performance and reduce load.
o How? Add indexes on frequently used columns, reduce repeated queries (cache some data in sessions or memory).
  1. Factor out common code
o Why? Avoid duplication (e.g., reCAPTCHA checks, Twig rendering). Centralize this logic into helper methods or services.
  1. Use a proper templating structure (Twig, Blade, etc.)
o Why? Create reusable layouts (header, footer) and specific templates for each page or section.
o How? Organize them in separate folders (templates/admin/, templates/auth/, etc.).
  1. Secure and isolate the installer/ folder
o Why? Installation/upgrade scripts should not be publicly accessible in production.
o How? Restrict access (via .htaccess or server config) or remove the folder after setup.
These improvements will make your application more secure, performant, and maintainable.