I'm working on a CMS system. The basis is pretty much done but before going any further I would like to know if there are things I really should change in the way I code things.I am pretty sure there will be a few things that could be done different, since I pretty much started with this project without any actual prior experience in writing my own php/sql projects. I'd like to know if there are some things I shouldn't change but most of all things I should change or be cautious of in the way I do things.I will be including the files that mainly contain functions.There are some more files involved but these are the most important ones.You can also view an example of the site at: http://www.tulexi.net/tulexi_dev/Functions.m - Used for interfaces<?phpfunction show_content($id,$category){ global $con; if($category == 'news'){ $sql = SELECT n.id, n.title, n.author, n.content, n.date, u.username   FROM news AS n, users AS u   WHERE n.author = u.id && n.id = :id; $q = $con->prepare($sql); $q->setFetchMode(PDO::FETCH_ASSOC); $q->bindParam(':id', $id, PDO::PARAM_INT); $q->execute(); foreach($q->fetchAll() as $news){  $author_id = (int)$news['author'];  $author = $news['username'];  $title = $news['title'];  $content = $news['content'];  $date = date('d-M-Y / H:i', strtotime($news['date']));  $edit_button = '';  $delete_button = '';  if(isset($_SESSION['userid']) && $_SESSION['userid'] == $author_id && session_level(2) || session_level(3)){   $edit_button = '<a href=?page=edit_news&id='.$id.'><img align=right src=./images/edit.png></a>';   $delete_button = '<a href=./process.php?action=delete_news&id='.$id.' class=confirm><img align=right src=./images/delete.png></a>';  }  $news = '<div class=wrapper pad_bot2>  <figure class=left marg_right1 user_image><img src=./user_images/'.$author_id.'.jpg alt=></figure>  <div class=title>'.$title.$delete_button.$edit_button.'</div>  <div class=date>From: '.$author.' On: '.$date.'</div>  <p>'.bbcode($content).'</p>  </div>';  echo $news;  } }}function list_news($max) { global $con; //Count amount of rows currently in DB. $count = $con->query(SELECT id FROM news)->RowCount(); if(!isset($_GET['nr'])||$_GET['nr']<1){  $page= 1; }else{  $page = $_GET['nr']; } $start = ($page-1)*$max; $prev = http_build_query(array_merge($_GET, array('nr'=>$page-1)),'&'); if($start <= $count){  $next = http_build_query(array_merge($_GET, array('nr'=>$page+0)),'&'); } else {  $next = http_build_query(array_merge($_GET, array('nr'=>$page+1)),'&'); } $sql = SELECT n.id, n.title, n.author, n.content, n.date, u.username   FROM news AS n, users AS u   WHERE n.author = u.id   ORDER BY n.date Desc   LIMIT :start, :max; $q = $con->prepare($sql); $q->setFetchMode(PDO::FETCH_ASSOC); $q->bindParam(':start', $start, PDO::PARAM_INT); $q->bindParam(':max', $max, PDO::PARAM_INT); $q->execute(); echo '<div class=paging><a href=?'.$prev.'>&lt;Newer</a> | <a href=?'.$next.'>Older&gt;</a></div>';  foreach($q->fetchAll() as $news){  $id = $news['id'];  $author_id = (int)$news['author'];  $author = $news['username'];  $title = '<a href=?p=home&id='.$id.'>'.$news['title'].'</a>';  $content = $news['content'];  $date = date('d-M-Y / H:i', strtotime($news['date']));  $edit_button = '';  $delete_button = '';  if(isset($_SESSION['userid']) && $_SESSION['userid'] == $author_id && session_level(2) || session_level(3)){   $edit_button = '<a href=?page=edit_news&id='.$id.'><img align=right src=./images/edit.png></a>';   $delete_button = '<a href=./process.php?action=delete_news&id='.$id.' class=confirm><img align=right src=./images/delete.png></a>';  }  $news = '<div class=wrapper pad_bot2>  <figure class=left marg_right1 user_image><img src=./user_images/'.$author_id.'.jpg alt=></figure>  <div class=title>'.$title.$delete_button.$edit_button.'</div>  <div class=date>From: '.$author.' On: '.$date.'</div>  <p>'.bbcode(truncate($content,200)).'</p>  </div>';  echo $news; }}function truncate($text,$max){ if(strlen($text) > $max+3){  return substr($text,0,$max).'[ellipsis]'; } else {  return $text; }}function categories_dropdown(){ global $con;  $sql = SELECT id, name   FROM categories   ORDER BY name; $q = $con->query($sql); $q->setFetchMode(PDO::FETCH_ASSOC); $q->execute(); foreach($q->fetchAll() as $categorie){  echo '<option value='.$categorie['id'].' class=select>'.$categorie['name'].'</option>';  }}function profile_edit($userid){ if(session_level(3) || $userid == $_SESSION['userid']){  global $con;  $sql = (SELECT mail    FROM users    WHERE id = :id);  $q = $con->prepare($sql);  $q->bindParam(':id', $userid);  $q->execute();  $row = $q->fetch();  $username = $_SESSION['username'];  $mail = $row['mail'];  echo '<div id=usercp>Welcome to your control panel '.$username.', here you can add or change settings for your account.<br>   <br>   Only fill in a field if it has to be changed.';  $form = '<form method=post action=./process.php?action=edit_userinfo>  <figure class=user_image><img src=./user_images/'.$userid.'.jpg></figure>  <div class=avatar>Avatar: <input name=user_image type=file />  <div class=note>.jpg files only. Required size is 100*100</div></div>  <div class=password>New Password: <input type=password name=password class=input /></div>  <div class=password>Confirm Password: <input type=password name=password2 class=input /></div>  <div class=mail>E-Mail adres: <input type=text name=mail class=input value='.$mail.'></div>  <input type=hidden name=userid value='.$userid.'>  <input type=hidden name=submit>  <input type=submit value=Apply Changes>  </form>';  echo $form.'</div>';  if(isset($_GET['s'])){   echo '<br>User info has been changed.';  } }  else {  echo 'You are not authorized to vieuw this page.';  die(); }}?>Functions.db - Used to add or change database information<?phpfunction addnews($title,$content,$date,$author){ global $con; $sql = INSERT INTO news   (title,    content,    date,    author) VALUES   (:title,    :content,    :date,    :author); $q = $con->prepare($sql); $q->execute(array(':title'=>$title,       ':content'=>$content,       ':date'=>$date,       ':author'=>$author));}function editnews($title,$content,$date,$id){ global $con; $sql = UPDATE news   SET title = :title,    content = :content,    edit_date = :date   WHERE id = :id; $q = $con->prepare($sql); $q->execute(array(':title'=>$title,       ':content'=>$content,       ':date'=>$date,       ':id'=>$id));}function delete_news($id){ global $con; $sql = SELECT author   FROM news   WHERE id = :id; $q = $con->prepare($sql); $q->execute(array(':id'=>$id)); $row = $q->Fetch(); if($_SESSION['userid'] !== $row['author'] && !session_level(3)){  header('Location: ./');  die; } $sql = DELETE FROM news   WHERE id = :id; $q = $con->prepare($sql); $q->execute(array(':id'=>$id));}function addcontent($title,$content,$date,$author,$category){ global $con; $sql = INSERT INTO content   (name,    content,    date,    author,    category) VALUES   (:name,    :content,    :date,    :author,    :category); $q = $con->prepare($sql); $q->execute(array(':name'=>$title,       ':content'=>$content,       ':date'=>$date,       ':author'=>$author,       ':category'=>$category));}function edit_userpassword($password, $salt, $userid){ global $con; if($userid !== $_SESSION['userid'] && !session(3)){  echo 'You do not have permission to execute this action. <a href=./>Return to homepage</a>';  die(); } else { $sql = UPDATE users   SET password = :password,    salt = :salt   WHERE id = :id; $q = $con->prepare($sql); $q->execute(array(':password'=>$password,       ':salt'=>$salt,       ':id'=>$userid));  }}function edit_usermail($mail, $userid){ global $con; if($userid !== $_SESSION['userid'] && !session(3)){  echo 'You do not have permission to execute this action. <a href=./>Return to homepage</a>';  die(); } else { $sql = UPDATE users   SET mail = :mail   WHERE id = :id; $q = $con->prepare($sql); $q->execute(array(':mail'=>$mail,       ':id'=>$userid));  } }?>
Practical advise for CMS
php;optimization;mysql