brahmnoor/prebook

Movie booking website, with user login, a seat booking page (showing the available seats), commenting, and movie history. (Implemented in PHP and mySQL)

Note - A MongoDB & Express based version of this exists on this repo! So take your pick.

PreBook

A movie booking website made in HTML, PHP, MySQL and occasional snippets of Javascript. Key features -

1. User login & registeration - using PHP sessions and a MySQL database.
2. Movie booking - with seat selection, hall selection, time selection.
3. Commenting - To post reviews of a specific movie.
4. User buy history - to quickly checkout the history of tickets purchased by a user.

Important Note - This is not ready for production, because it has multiple problems arising in real life (see future updates should include section). It was built as a project, and should be appropriate as a starting point.

Future Updates should Include

Reasons why you shouldn't put this up on a production level yet.

1. Hashing password. Storing unsalted, unhashed passwords should be a crime.
2. Adding a payment gateway.
3. Handling simuntaneous transactions (so a way to put a seat on a sort of hold for the duration of buying).
4. Adding email verification.

How to set it up

1. Edit the db.php files with the details of your MySQL database.
2. Use the backup.sql file to import the backed up database to your MySQL to make sure that the database schema is similar.
3. Profit! :)

Try Me?

1. Of course. You can try me out.
2. Also, you can see the screenshots below.

Screenshots

prebook's Issues

Feedback

A few things you should fix immediately:

• Read up on "mysql injections" and "prepared statements"
  https://github.com/brahmnoor/PreBook/blob/master/create.php#L38

• Read up on XSS attachs
  https://github.com/brahmnoor/PreBook/blob/master/buyticket.php#L52

• You should (can) not send http headers after any content has been sent to the client.
  https://github.com/brahmnoor/PreBook/blob/master/create.php#L48

• Move your credentials out to a separate config file (take a look at env files)
  https://github.com/brahmnoor/PreBook/blob/master/db.php#L5

• PHP config belongs into the server's php.ini. Don't overwrite values in your code
  https://github.com/brahmnoor/PreBook/blob/master/db.php#L3

• Separate your logic from your views. Don't execute queries in your views. Look up MVC architecture.
  https://github.com/brahmnoor/PreBook/blob/master/buyticket.php#L39

• Don't die in the middle of your page. Catch exceptions and handle them gracefully.
  https://github.com/brahmnoor/PreBook/blob/master/buyticket.php#L48

• Don't put CSS in your markup.
  https://github.com/brahmnoor/PreBook/blob/master/buyticket.php#L63

• Extract common markup into their own files and include them.
  https://github.com/brahmnoor/PreBook/blob/master/seatplantry.php#L23

• Hash your passwords
  https://apzentral.github.io/php-the-right-way/#password_hashing
  https://github.com/brahmnoor/PreBook/blob/master/create.php#L38

Passwords are saved un-hashed and unsalted

This should be a crime. The simplistic solution is to add a hashing mechanism before the passwords are sent to the server.

Putting a seat on hold

There should be a way to put a seat on hold, so that two users can simultaneously book a seat in the same theatre.