kemoycampbell / amazo Goto Github PK

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L605
Instead of ===, use hash_equals() http://php.net/manual/en/function.hash-equals.php (requires PHP 5.6)

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L37
By doing this, you let the language do the validating for you, no need to validate it yourself.
$config = new Amazo\Config('dbUser', 'dbPassword', 'dbDSN'); $amazo = new Amazo\Amazo($config);
Where Amazo\Amazo constructor typehints for Amazo\Config. And since Amazo\Config's constructor requires you to supply it with those arguments, you can be guaranteed that Amazo\Amazo has been constructed correctly. No need to validate an array. Leverage the language instead.

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L330
That's fine for testing things out and then setting the cost as a configuration option, but doing it on the fly is simply not good. It's being called multiple times, which completely defeats the purpose of trying to stick to a specific time cost!
The purpose of the 50ms rule of thumb is that it's just long enough to mitigate brute force if the database is breached, but not so costly that it would create a DOS vulnerability. If you're simply guessing every time it's run, then you're making the server do more work anyway.
Instruct the developer to use it as a utility on their production environment to determine what value to set ahead of time, and then set that value as configuration. Never call generatePassCost() in your code.

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L67-L69
Simply store the config object, and then call it as needed:
$this->config->getDBUsername();

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L148
This:
if($stmt->rowCount() > 0)
{
return true;
}
return false;
Is exactly the same as this:
return $stmt->rowCount() > 0;
Another example: https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L361-L369
Can simply be written as:
return !preg_match('/[^A-Za-z0-9]/', $string);

You are referencing $GET when you really mean $_GET. code snippet:

if(isset($_POST[$crfname]) || isset($GET[$crfname]))

In some places you have if( and in others you have if ( (notice the space between the parens and the keyword?)
Be consistent in everything you do.

https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L593-L631
Nested conditionals like this can be drastically simplified. Look up "guard clauses" and "return early".