Capstoneintermediate6h

PHP Blog CRUD Backend

Design (on paper/in guided steps, since this platform can't execute PHP) a small server-rendered blog backend in PHP, applying classes, arrays, and basic web-security practices.

Tracks: PHP Web Development

Open in Project Studio

Objectives

Design a Post class (title, body, author, created-at) and a PostRepository for CRUD operations
Handle form submission via $_POST to create a new post, validating input before saving
Use prepared statements (conceptually) for any database query, never string-concatenated SQL
Escape all output with htmlspecialchars() to prevent XSS when rendering posts back to HTML

Before you start

Milestones

1. Design the Post class and repository

Define a Post class and a PostRepository with create/read/update/delete methods.

Post has at minimum title, body, author, and a created-at timestamp
PostRepository's methods are named clearly (create, findById, update, delete)

2. Handle form submission safely

Read $_POST data to create a new post, validating that required fields aren't empty.

Missing/empty required fields are rejected with a clear error, not silently saved
Input is validated before it reaches the repository, not after

3. Use prepared statements for any database access

Describe (conceptually, no live database here) how every query uses bound parameters, never concatenated SQL.

No example query concatenates raw user input directly into SQL text
Parameter binding is used for every value that comes from user input

4. Escape output to prevent XSS

Ensure every place a post's title/body is rendered back into HTML uses htmlspecialchars().

Every user-supplied field rendered into HTML is passed through htmlspecialchars()
The design explains why this matters even for content from 'trusted' logged-in users

References

PHP official manual