I'm an experienced developer myself but for a current project I am working on I have decided to hire some developers to develop a mobile app which requires some supporting web services (developed in PHP).I know myself that the code I have pasted below is worse than what I would expect a 5 year old to produce after spending 5 minutes reading Dummy's Guide to Programming PHP Badly. However, this is meant to be a professional software development company!After a quick perusal I can see that it is wide open to basic SQL injection attacks, conforms to no web services standard I know of, barely uses any sound principles of software design or architecture and quite frankly I think it must be some kind of practical joke.I was wondering if anyone else could help me out by pointing out the problems in this code and/or just generally tearing it apart and having a good laugh at it. I might then show this page to our developers in the hope that they can take on some of this feedback and hopefully end up producing some code that I would dare to put into a production environment.Note: The code I have pasted below is not doctored. It includes all the useful comments and descriptions that the developers have kindly left for us to make it easy to maintain.This is the 'Front Controller':<?phpinclude includes/dbconnect.php;include user_class.php;$userval = new userinfo();switch($_POST['action']){       //****** User profile Class *******//case login:    $user=$userval->emailsign($_POST);break;case emailsignstp2:    $user=$userval->emailsignstp2($_POST);break;case usersignIN:    $user=$userval->usersignIN($_POST);break;/*case register:    $user=$userval->user_registration($_REQUEST, $_FILES);break;case logout:    $user=$userval->logout($_REQUEST);break;*/}echo json_encode($user);//print_r($user);?>And the API class itself:<?phpini_set(display_errors, 1);if($_SERVER['HTTP_HOST'] == localhost/whatittext/) {//define('DOMAIN', http://localhost/nglcc/profile_img/);} else {define('DOMAIN', http://myapi.com/);}class userinfo {       function emailsign($email){    $whatittext['emaillogin'] = array();        $uemail = $email['uemail'];    if (!preg_match(/^[^@]{1,64}@[^@]{1,255}$/, $uemail)) {            $whatittex[emaillogin][result]=false;            $whatittex[emaillogin][error]=Inalid email;        }else{        $sql=mysql_query(select count(*) AS `cct`, t1.*  from `users` AS t1 where t1.`uemail`='.$uemail.' AND t1.`status`= '1') or die(mysql_error());        $row = mysql_fetch_array($sql);        if($row['cct'] > 0)        {            $whatittex[emaillogin][result]=true;            $whatittex[emaillogin][uname]=$row['uname'];            $whatittex[emaillogin][uemail]=$row['uemail'];            $whatittex[emaillogin][create_dt]=$row['create_dt'];            $whatittex[emaillogin][ucountry]=$row['ucountry'];        }        else        {            $whatittex[emaillogin][result]=false;            $whatittex[emaillogin][error]=Email address dose not exist.;        }    }    return $whatittex[emaillogin];}function emailsignstp2($emailpass){    $whatittext['emaillogin'] = array();    $uemail = $emailpass['uemail'];    $upass = $emailpass['upass'];        if (!preg_match(/^[^@]{1,64}@[^@]{1,255}$/, $uemail)) {            $whatittex[emaillogin][result]=false;            $whatittex[emaillogin][error]=Inalid Email;    }else{        $sql=mysql_query(select count(*) AS `cct`, t1.*  from `users` AS t1 where t1.`uemail`='.$uemail.' AND t1.`upassword`='.$upass.' AND t1.`status`= '1') or die(mysql_error());        $row = mysql_fetch_array($sql);        if($row['cct'] > 0)        {            $whatittex[emaillogin][result]=true;            $whatittex[emaillogin][uname]=$row['uname'];            $whatittex[emaillogin][uemail]=$row['uemail'];            $whatittex[emaillogin][create_dt]=$row['create_dt'];            $whatittex[emaillogin][ucountry]=$row['ucountry'];        }        else        {            $whatittex[emaillogin][result]=false;            $whatittex[emaillogin][error]=Invalid email or password.;        }    }    return $whatittex[emaillogin];}function usersignIN($signin){    $whatittext['emaillogin'] = array();    $uemail = $signin['uemail'];    $upass = $signin['upass'];    $uname = $signin['uname'];    $ucountry = $signin['ucountry'];        if (!preg_match(/^[^@]{1,64}@[^@]{1,255}$/, $uemail)) {            $whatittex[emaillogin][result]=false;            $whatittex[emaillogin][error]=Inalid email;        }else{            $sql=mysql_query(select count(*) AS `cct`  from `users` where `uemail`='.$uemail.') or die(mysql_error());            $row = mysql_fetch_array($sql);            if($row['cct'] > 0)            {                   $whatittex[emaillogin][result]=false;                $whatittex[emaillogin][error]=Email address already exist.;            }            else            {                       if($uemail=='' || $upass=='' || $uname=='' || $ucountry=='')                    {                        $whatittex[emaillogin][result]=false;                        $whatittex[emaillogin][error]=Please fill all of the following option properly.;                    }                    else                        {                            $sql2=mysql_query(select count(*) AS `cct2`  from `users` where `uname`='.$uname.') or die(mysql_error());                            $row2 = mysql_fetch_array($sql2);                            if($row2['cct2'] > 0)                            {                                   $whatittex[emaillogin][result]=false;                                $whatittex[emaillogin][error]=User name already exist.;                            }                            else                            {                            $sql=mysql_query(insert into `users` set `uemail`='.$uemail.', `uname`='.$uname.', `upassword`='.$upass.', `ucountry`='.$ucountry.');                            $whatittex[emaillogin][result]=true;                            $whatittex[emaillogin][uname]=$uname;                            $whatittex[emaillogin][uemail]=$uemail;                            $whatittex[emaillogin][ucountry]=$ucountry;                            }                        }            }    }    return $whatittex[emaillogin];}/*function user_login($arr) //LOGIN//{       $login[whatittext] = array();    $email=$arr['email'];    $password=$arr['pass'];    if (!eregi(^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$, $email))    {    $login[nglcc][result]=false;    $login[nglcc][error]=Inalid Email;    }    else if(trim($password)!=)        {        $sql=mysql_query(select * from `user` where `email`='.$email.' AND password='.$password.' AND `status`= '1');        $rows=@mysql_num_rows($sql);            if($rows == 1)            {            $row = mysql_fetch_assoc($sql);            $r[0] = $row;            mysql_query(update `user` set `login_status`='1' where uid=.$row['uid']);            $login[nglcc][result]=true;            $login[nglcc][login_info] = $r;            }            else            {            $login[nglcc][result]=false;            $login[nglcc][error] = Invalid email/password;            }        }    else        {        $login[nglcc][result]=false;        $login[nglcc][error]=Email/password should not blank;        }    return $login;}*/}?>
User login and signup system
php5;authentication
In order of badness.SQL injection (as you pointed out).Plaintext passwords, hold the salt.  Obviosuly no investigation was done on how to deal with passwords.mysql_* is softly deprecated now deprecated.Horrible double line-spacing (Choose every second line and start again.  I'd choose the blanks.)Item by item setting of an array.  Build the whole thing in a single statement.Lowercase is not a valid choice for naming methods and variables (e.g $whatitext, ->emailsignstp2), use pascal or camel case.Horrible variable name $whatitex (probably mispelt) also $whatitext.The User class is completely pointless, it is a group of functions. Fake OO sucks.  Seriously, just use a namespace and normal functions.Validation of the email is woeful. See: filter_varNo useful comments.Pointless abbreviation of method emailsignstp2.Randomly commented code shouldn't exist when using a revision control system.I'm sure I have missed a few things.  This was unprofessional work.  They will need to learn very quickly.  I wouldn't want them doing any serious work (especially if they were trying to write it with classes in an OO style).