I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can...The way I am trying to design this CMS is to keep including 'modules' within a page to minimize code. I am using extensively POST and GET variables to decide which module will be reached. The Index page will be the main page from which modules will be included and accessible.My questions:Will this design be handy when code get more and more complicated? More POST requests etc. I could there be any security vulnerabilities?Any performance issues? (None noticed)Do I utilize code properly as this is my real PHP project?I would love some intensive criticism about this code.Config File:<?php    class cms {        private $dbhost     = ;        private $dbuser     = ;        private $dbpass     = ;        private $dbdb       = ;        private $dbc;        public $website;        public $user;        public $theme;        function __construct() {            $this->session();            $this->getWebsite();        }        function connect() {            $dbc = mysqli_connect($this->dbhost, $this->dbuser, $this->dbpass, $this->dbdb) or die(Error  . mysqli_error($dbc));            return $dbc;        }        function session() {            if(!isset($_SESSION)) {                session_start();            }        }        function getWebsite() {            $dbc = $this->connect();            $stmt = $dbc->prepare(SELECT * FROM website);            $stmt->execute();            $result = $stmt->get_result();            $this->website = $result->fetch_assoc();            $stmt->close();            $this->theme = $this->website['theme'];        }    }?>Index.php File:<?php    require_once('config/config.inc.php');    $cms = new cms();    include(template/ . $cms->theme . /head.php);    $moduleArray = array_diff(scandir('module/', 1), array('..', '.', 'admin'));    if(($_SERVER['REQUEST_METHOD'] === 'GET' || $_SERVER['REQUEST_METHOD'] === 'POST') && !empty($_GET['page'])) {        $p = $_GET['page'];        $ext = .inc.php;        if (get_magic_quotes_gpc()) {            $p = stripslashes($p);        }        if(in_array($p . $ext, $moduleArray)) {             include(module/ . $p . $ext);        }        else {            header('Location: /');        }    } // end (GET || POST) && GET    else {        foreach($moduleArray as $module) {            $name = substr($module, 0, -8);            echo  <a href=\index.php?page=$name\> $name </a><br />;        }    } // end ELSE    include(template/ . $cms->theme . /foot.php);?>Demo Module: Page.inc.php<?php    $dbc = $cms->connect();    if(isset($_GET['page'])) {        if(isset($_GET['title'])) {            $t = $_GET['title'];            if (get_magic_quotes_gpc()) {                $t = stripslashes($username);            }            if ($stmt = $dbc->prepare(SELECT title, content_main FROM pages WHERE url=?)) {                       $stmt->bind_param('s', $t);                $stmt->execute();                $stmt->store_result();                $stmt->bind_result($title, $content_main);                if($stmt->fetch()) {                    echo <h2>$title</h2><p>$content_main</p>;                }                else {                    echo <h2>404</h2><p>The page doesn't exist!</p>;                }                $stmt->free_result();                $stmt->close();            }            else {                echo error;            }        }        else {            if ($stmt = $dbc->prepare(SELECT title, url FROM pages)) {                        $stmt->execute();                $stmt->store_result();                $stmt->bind_result($title, $url);                while ($stmt->fetch()) {                    echo <a href=\index.php?page=page&title=$url\>$title</a></br />;                }                $stmt->free_result();                $stmt->close();            }        }    }    else {        header('Location: ../');    }?>
How is my CMS design? Any security, design, or other issues?
php;object oriented;design patterns;security
Developementoop & design-patterns tags you've used are already saying what needs to be done here. At this moment it's a structural code (with some class syntax) and it will be very difficult to expand. Even though it doesn't look like a big project yet and you don't need deep object structures/layers here, I think you should learn some oop anyway. First advantage you'll notice will be less reapeating code. Separation of Request processing, Modeling page content and fetching it further to the View code that will handle displaying will make developement much easier. I think that How to write this code in oop manner? should be the question here.SecurityThere not much security concenrs in the code you've shown. Using prepared statements will protect you against SQL injection and I don't expect more at the moment assuming that displayed content is supplied by site owner (but owner recognition is important here). Even injection itself wouldn't be a problem if you validate request first (mentioned above). I'm not saying you should drop prepared statements - stick with it even if sometimes it's only for good practise sake.PerformanceNo need for file whitelisting using directory scan and checking if request hits one of the files. I'd simply use file_exists() (with some conditions if needed). And again: it could be part of request validation.Storing page content in database is an overkill imo since you display it directly to the screen. Why not writing it as files? You don't and can't really do anything data-processing-wise with it (sorting, grouping...) except for FULLTEXT search maybe (that could be resolved another way). Simple include would replace db SELECT. Same goes for website table - it looks like a (semi-)constant config that could be stored in file (as a db cache at least).