This class sends tweet data to the client in the form of a custom markup language.  How can it be improved?It is used in Ajax call and in previous post people have suggested not to echo the result..but this is my primary means of communicating with the server via Ajax responseText.Also <tw_p> is used to denote a pass and is read by the client.  The markup looks like this.field 1 | field 2 | field 3 | field 4 || field 1 | field 2 | field 3 | field 4 ||It is called like this - new tweet();The client knows how render this into xhtml once it receives it./*tweet*/class tweet extends post  {  function __construct()    {    parent::__construct();    $email=$_SESSION['email'];    $flname=$_SESSION['name'];    $message=$this->_protected_arr['f4b'];    $time=time();    database::query(INSERT INTO tw VALUES ('$time','$flname','$message','$email'));            $query_return = database::query(SELECT * FROM tw ORDER BY time DESC LIMIT 7);    $b=0;    $c='<tw_p>';    while($a=mysqli_fetch_assoc($query_return))      {        if($b==0)        {        $c = $c . $a['email'] . | .  $a['fname'] . | . $a['time'] . | . $time . | . $a['message'];        }      else        {        $c = $c . || . $a['email'] . | .  $a['fname'] . | . $a['time'] . | . $time . | . $a['message'];        }      $b++;      }    echo $c;    }  }
class - tweet - 0 - to_do
php;php5
I agree with @Paul's answer. Some additions below.Possible SQL injection:$email=$_SESSION['email'];$flname=$_SESSION['name'];$message=$this->_protected_arr['f4b'];$time=time();database::query(INSERT INTO tw VALUES ('$time','$flname','$message','$email')); If your name and email session variables are checked before you put them into the session and they could not contain any dangerous characters it's fine. If they could contain you should escape them. (Image a name with an '. It would broke the query.) Anyway, escaping is a good practice, it costs almost nothing and makes the code more reliable and safe. I would escape it.I would rewrite the while loop if you stay with the original code instead of JSON:$first = true;while($row = mysqli_fetch_assoc($query_return)) {      if (!$first) {        $c .= ||;    }    $tw  = $row['email'] . |;    $tw .= $row['fname'] . |;    $tw .= $row['time'] . |;    $tw .= $time . |;    $tw .= tw_escape($row['message']);    $c .= $tw;    first = false;}The $tw variable removes some unnecessary code duplication. Changing the $b to a boolean ($first) makes is easier to read.You should escape at least the message (that's the tw_escape function) in case a message contains |. Consider escaping the $row['fname'] too. Don't forget to unescape on the client side. Maybe JSON does it out-of-the-box.