Show HN: Instanote – self-hosted pinboard

Instead of reading from and writing to a JSON file, use a database... this is the kind of thing they were made for, after all. If you do, though, use PDO[0,1] to prevent SQL injection.

Also, instead of md5, which is a very weak and thoroughly broken algorithm, use password_hash[2,3] along with password_verify[4] to compare in a way that's safe against timing attacks. Also don't authorize users by storing the password in a cookie, even as a hash. The typical way to do authorization is through secure sessions. Users can't create session cookies, but they can create arbitrary POST variable and cookies with their own hashed values, which means it's probably possible for anyone to authorize themselves with minimal effort.

I'm also just assuming you've got some XSS issues as well because I don't see any attempts to escape variables in templates.

You've publicly exposed phpinfo() which makes it easier to tailor exploits for your PHP installation.

I notice you seem to have a startup as well. I really hope for the sake of your users that it's built a bit more substantially.

[0]https://code.tutsplus.com/tutorials/why-you-should-be-using-...

[1]https://phpdelusions.net/pdo

[2]http://php.net/manual/en/function.password-hash.php

[3]https://stackoverflow.com/questions/30279321/how-to-use-pass...

[4]http://php.net/manual/en/function.password-verify.php

> PHP 5.2

Why? The 5.2.x line hasn't been supported for 7 years.

> MD5

Wat. Just. No. Don't.

> chmod 777

Wat^2. Holy shit balls. No. This is ridiculous.