Simple Machines prides itself on its clean and pure code. This document provides guidelines for all coding done in relation to Simple Machines including Simple Machines Forum. This includes all development done by the SMF Team and users affecting customizations (mods/themes), core development, and tools. As with most things in life, there may be circumstances where these guidelines cannot be followed exactly. Breaking them, however, should be a last resort.

Hopefully, these guidelines will better explain the Simple Machines code.

Preface

This document is meant for semi-experienced users. As such, it does not define many basic terms such as CSS, HTML, PHP, and MySQL. It is better to familiarizing oneself with those topics before continuing with these guidelines. The term ‘foobar’ is used throughout this document as a placeholder for real variable and function names.

Please see the SMF Coding Discussion board in the SMF Community Forums for answers to further questions. The function database contains additional information about the files, functions, and variables described in this document.

This document is free for distribution. Please translate this to as many languages as possible.

Model View Controller (MVC)

SMF is based on a Model-View-Controller (MVC) architecture which separates content and presentation. The software uses the action present in the URL and the file associated with that action to function as the controller. Various loading and processing functions serve as the models, and the many theme and template functions make up the views.

Each group of actions should have their own controller file. For instance, admin actions use Admin.php. Supporting functions and/or functions that are used in multiple controllers should be placed in a model file. In the case of Admin.php we use Subs-Admin.php. The last piece of the puzzle is to create a view file – Admin.template.php.

The view is divided into two parts – structure (PHP & HTML) and presentation (CSS). Although, not all templates have their own CSS file – that would be overkill. Structure is then split into two parts – template functions and a separate language file. If you're looking for the various files, you can find controller and model files in the 'Sources' directory, the view files in the 'Themes' directory, and the language files in the default theme directory in a sub-directory called 'languages.' The actual locations of these directories may vary across SMF installations, but they default to the forum's root directory.

Naming Conventions

Code for any Simple Machines product should use the following naming conventions.

Descriptive Naming

• The name of the variable or function should describe what it is or does. For instance, use $message_settings instead of $mset.
• The name of the variable or function should signify what the object is being used for, not where it is to be used.
• English should be used as the default language when choosing a name for variables or functions.

Camel Case and Underscores

• Underscores ($foo_bar) or camelCase ($fooBar) should be used.
• Do not use camel case when naming tables, columns, or indexes in databases. They do not work in all database systems.

Database

• When a column is an ID, it should prefixed with ‘id_’ as in ‘id_member’.
• Tables with the purpose of logging should be prefixed with ‘log_’ as in ‘log_errors’.

Files

• When displaying an index of information to a user such as BoardIndex.php and MessageIndex.php, the file name should end with 'Index'.
• A file that is used for the management of a feature like members should be prefixed with ‘Manage’. For instance, SMF's file is named ManageMembers.php.
• Files that are not the controller file for an action, but instead contain many functions that can be used in several files, should be prefixed with 'Subs-'. For instance, SMF's posting functions are placed in a file called Subs-Post.php.
• Classes should have their own file, prefixed with 'Class-'.

Cascading Style Sheets (CSS)

• ID and class names should be lower case.
• ID and class names should always describe what they do, not where they are to be used.

CSS Examples

/* WRONG! This class name tells where the element goes. */
.rightmenu
{
}

/* CORRECT! This class name tells what the element is or does. */
.profilemenu
{
}

Database

While SMF 1.1.x only supports MySQL, SMF 2.0 supports multiple databases. Following these guidelines is extremely important to make sure that remains so.

Functions

• Do not use database-specific functions to send a query to the database (i.e. - mysql_query() for MySQL). Use $smcFunc['db_query']().
• Do not use database-specific functions to handle query results (i.e. - mysql_fetch_array() or mysql_fetch_assoc() in MySQL). Most of the time, the associative array returned by $smcFunc['db_fetch_assoc']() should be used. In rare cases like when using list(), $smcFunc['db_fetch_row']() may be used.
• Always use $smcFunc['db_free_result']() to free the resource when they are no longer needed.

Queries

Queries have the ability to make a forum run fast or to cripple it. It all depends on how the query is designed. Queries should be optimized as much as possible.

• Queries should never be in the template files.
• Most of the time it is best to use joins instead of using multiple queries or subselects. Sometimes this is not the case. Simple benchmarking will reveal the differences.
• Do not use UNION, SET PASSWORD, BENCHMARK, subselects, or comments in a query.
• Use LIMIT whenever the WHERE clause contains a column that does not have a UNIQUE index – to include primary keys.
• SELECT * should not be used. Queries should only select columns that are needed.
• Do not use shorthand INNER JOIN, as it may not be supported in all database systems.
• All keywords should be capitalized.
• When using more than one table in a query, use an alias for the table name.
• Always use {db_prefix} before the table name.
• Never use reserved words.
• Do not add the database name to tables.
• All comments should be before the call to $smcFunc['db_query'](). There should be no comments inside of queries.
• Do not rely on the default value. When performing an INSERT, columns for which there is no value should be excluded.

Whitespace

Whitespace is important in making code easier to read and follow. Whitespace should be used in the following situations.

• Use one LF after $smcFunc['db_query']('.
• Indent once past the base of the query.
• Use one space after each keyword, column name, and table name.
• Do not use spaces when using a function such as COUNT(column).
• Each of the following keywords should be on their own line: SELECT, DELETE, UPDATE, FROM, JOIN, LEFT JOIN, WHERE, AND, OR, GROUP BY, ORDER BY, LIMIT, etc.

Exception: when AND & OR are used in a sub-condition, they do not need to be on their own line.

Query Example

// Get their name and part of their address (excuse the wrapping)
$result = $smcFunc['db_query']('
    SELECT ppl.first_name, ppl.last_name, add.city, add.address
    FROM people as ppl
    LEFT JOIN addresses as add ON (add.id_address = ppl.id_address)
    WHERE ppl.id_person = {int:person}
    AND (ppl.middle_name = 'foo' OR ppl.suffix != 'jr')
    AND {bool:condition},
    array(
        'person' => $id_person,
        'condition' => $condition,
    )
);

Schema

• All tables should use the $db_prefix.
• Tables should work with HEAP or MyISAM. Do not expect a user to have InnoDB or any other engine enabled.
• If a column has no reason to ever be NULL, specify NOT NULL. This saves space in the table data.
• Use default values whenever possible. Always assume that those values may be used at some point.
• Use the smallest data type possible, but remember that it needs to scale. Come up with reasonable maximums for IDs, and that will be the maximum size of your column. Use a corresponding column type.
• Remember that using an UNSIGNED number will nearly double the amount of rows allowed. Use UNSIGNED when are you defining an ID.
• Primary keys are strongly recommended.

Schema Example

 CREATE TABLE {$db_prefix}mountains
 (
     id_mountain smallint(5) unsigned NOT NULL auto_increment,
     name varchar(25) NOT NULL default '',
     date_found int(10) unsigned NOT NULL default '0',
     PRIMARY KEY (id_mountain),
     KEY found(date_found)
 ) TYPE = MyISAM;

PHP

Whitespace

• Use the BSD/Allman indentation style.
• Use Unix line feeds (LF) instead of carriage returns like the old Mac® style (CR) and not a combo like Windows® (CR+LF). That does not mean use Unix indentation style.
• No whitespace at the end of lines.
• Use tabs, not spaces, for proper indentation.
• There is no need to use braces (curly brackets) for one line of code after a control structure.
• Use braces (curly brackets) for switch ... case and every other time there are multiple statements.
• Do not use a space between function names and ();. So, use fooBar(); and not fooBar ();.
• Spaces should be before and after an equal sign. For example $var = 'foo';.
• When many common assignments are being done, it is common to use more space so that all of the assignments align with each other. This is acceptable.
• There should be no extra line after the closing ?>.
• Each statement should be on its own line.
• Use one space between control structures and parenthesis such as if (), elseif (), for (), while (), etc.
• Use one space after language constructs such as echo, list, require, etc.
• Do not indent statements in the global scope (not inside of a class, function, statement, etc.).
• Every argument, except the last, in an argument list should have a space after the comma.
• When declaring (not using) a function, there should be a space between the function name and the (. So, use fooBar () and not fooBar().
• Use one space before and after the . when concatenating.

Functions & Language Constructs

• Arguments with default values go at the end of the argument list in the function definition. For example, function foo ($bar, $var = true, $arg = 'foobar');.
• Wrapper functions (functions that do nothing more than call another function) should not be used.
• Use isset() instead of array_key_exists().
• Use empty() instead of isset() && $var != '' && $var != 0 && $var != false.
• Use include_once() instead of include() and require_once() instead of require(). Code that needs to run more than once should be inside of a function.

Variables

• Initialize all variables.
• Although there may be the rare case where a constant is desired, they should be used sparingly. Variables intended for the global scope should be declared with global. When constants are necessary, they should be uppercase.
• There are some special variables such as $modSettings, $context, $sourcedir, etc. These variables should be used before creating new ones.
• $_GET and $_POST are available via $_REQUEST. It doesn't make a difference in terms of security to know where the data is coming from since all user data is dirty (see Security).
  • All $_REQUEST variables have been escaped. They should be unescaped in order to be used in normal content.
  • All $_GET variables have been modified with htmlspecialchars__recursive(). Undoing the special characters is necessary to use them in plain text.
• It is usually best to use an associative array instead of numeric.
• Avoid internal type changing/conflicts. PHP won't mind, but it will become confusing to keep track of that variable. For example, don't do $var = 'foo'; $var = $var == 'foo' ? true : false;.

Error Handling

• All code should be E-STRICT compatible.
• @ should almost never be used to silence an error. If an error is expected, it should be checked for first. For instance, when including a file, check to see if it exists if it is possible it doesn't. Otherwise, use require_once().
• Simple Machines has its own error handling functions. They should be used to return an error. They can be viewed in Errors.php.

Comments

• Comment often!
• Use comments to describe a block of code or as a placeholder for future code/mods.
• Comments should be unique per the file and should try to be unique per the entire application.
• Comments should be kept under 80 characters per line.
• One line comments should formatted with //, a space, the comment, and then a period.
• Multiple line comments should use /* */ with each one on its own line.

Comment Examples

// Here goes a one-liner... so a dog and a man walk in to a bar.
function do_something()
{
	foobar();
}

/*
This is my comment.
I want to comment some more.
Keep on commenting.
*/
echo 'I love Rock & Roll, put another dime in ©';

Miscellaneous Guidelines

• Always use <?php and ?>. Never use short tags!
• SMF uses procedural programming for most things. Object-oriented programming (OOP) should not be used unless creating an entire class. Future versions of this document will include guidelines for writing OOP PHP code.
• Use single quotes. Double quotes may be used to concatenate a variable, but should only be used in smaller strings.
• Free as many resources as possible.
• Do not use deprecated features or features that don't exist in the minimum version.

Proper PHP Example

<?php
// Copyright © 2007: Joshua Dickerson

foo_bar('x', 'woot');
if (empty($_REQUEST['bla']))
{
	require_once('some_file.php');
	have_fun();
}

// Declare a function.
function foo_bar ($arg, $arg1, $arg2 = false)
{
	global $modSettings, $context;
	static $counter;

	if ($arg2)
		ex_of_calling();
	elseif ($arg)
		$foo = array();

	foreach ($arg as $key => $value)
		$arg2 = $key;

	while ($arg1)
	{
		do_something();
		fooBar();
	}

	$abc = 123;
	$woot = 098;
	$yawie = 12;
}
?>

Output

Simple Machines has a lot of goals for output, including semantic markup, accessible output, usable output, valid XHTML 1.0 or HTML 4.01, and valid CSS2. This can be a bit confusing. To clarify, semantic markup means that the tags are used in a manner that make sense to humans and machines (like search engines). Use heading tags for headings, div tags to divide sections, p tags for paragraphs, etc. Markup must also validate in the document type, whether that be XHTML or HTML. The CSS must also be valid. There are a lot of browsers out there that accept mistakes/kludges in markup. Simple Machines doesn't. The accessible part is a little less simple. It means that markup should be all of the above, plus it should have the ability to change easily for people with physical impairments. Font size, screen size, etc. should be considered.

All output should be contained inside a template!

echo

Simple Machines uses one thing and one thing only to output to the browser – echo. print(), heredoc, and nowdoc should not be used. echo is not a function; it is a language construct. So, it does not require parenthesis around its input. Also, it accepts an unlimited number of arguments.

• Send multiple arguments with the use of commas instead of concatenation (using periods).
• Place a space after the comma, not before.
• Put line breaks inside of the quotes. There is no need to use "\n".
• PHP whitespace and markup whitespace do not relate. When output should be indented, tabs should be added. echo statements should still line up with the function and other statements that they are in as per the PHP guidelines.

Proper Echo Example

// Using a long string with no variables.
echo 'This is our very long string. We don\'t need any variables';

if ($code)
	echo $foobar;
else
	echo 'This is to show you what concatenation looks like
	', $txt['see'], 'what I mean by putting line breaks inside of quotes';

// Short string with variable.
echo "this $is a $short $string";

// Proper indentation and spacing.
if ($woot)
{
	echo '
<div>
	w00t!';

	if ($woot % 2 == 0)
		echo '
	<br />
	woot w00t woot';

	echo '
</div>';
}

Improper Echo Example

// DO NOT DO IT LIKE THIS!
echo "$var";
echo "output";
echo <<<EOD
heredoc $stupid heredoc
EOD;
print "bla \'bla\' bla";
echo 'See what I mean by line breaks?' . "\n",
	'Look at how bad this looks' . "\n" .
	'compared to just putting the line breaks in quotes.';

Usable & Accessible

These are two distinctly different and important terms that are rarely given too much thought. SMF has many types of users, and Simple Machines is devoted to making it possible for all users to access a page. Thus, differences between users must be considered. Making a page accessible does not mean that it shouldn't look good. Keeping these thoughts in mind should help achieve a usable and accessible page.

• A page should look and sound as good as possible. Remember, there are users out there that use screen readers.
• Some users may have a 21" monitor with a high resolution. Other users may be reading on a mobile device with a 2" screen and no graphics.
• A lot more users than expected disable JavaScript. Think about how many people might do so to avoid popups or ads.

Graceful Degradation

• All browsers should be able to use a page regardless of their JavaScript settings, screen size, operating system, browser version, etc.
• What can't be made to look pretty with JavaScript or CSS due to the browser should still work and look as good as possible.

HTML

• HTML is used to define the structure of a document, not the presentation (styling).
• Use HTML 4.01 or XHTML 1.0 transitional/strict doctype. Aim for strict.
• Usually, a list should be used for menus.
• Use <p> for paragraphs. Use <br /> only for a single line break. Additional necessary space should be created through extra CSS margins.
• Do not use <a name=”anchor”> for anchors. Use <{tag} id=”anchor”>, where {tag} is usually a header tag, since all ids are unique they act as anchors.
• Although <b>, <i>, <big>, <small>, <tt> are not deprecated, they are strictly for presentation. They serve no purpose other than to make output look different. To show emphasis on text, consider using <strong> or <em>. To create a heading, consider using <h#>.
• Here are some commonly used deprecated tags that should not be used:
  • <s> is often used to signify deleted text. Instead, consider using <del> and <ins>. If the strike through is only necessary for presentation, considering using the CSS text decoration "text-decoration: line-through;".
  • Do not use <pre> for code snippets. There are the <code> and <sample> tags for that.
  • Perhaps the most commonly used deprecated tag is <font>. This tag has no semantic value. Use <span> instead.
  • Internet Explorer does not support <q> or <button>. Do not use them.
• Tables are for tabular data! Think of a table as a spreadsheet. Would the data work well in a spreadsheet? Do not use a table simply to make layout easier.
• Use <th> and <caption> to define the data in the table.
• Forms are a block level tag. They do not require a wrapping div.
• Related fields should be grouped with a <fieldset> tag. All fieldsets should have a legend
• All form fields should have a label using the <label> tag.
• Related options in a select box should be grouped using the <optgroup> tag
• When creating a list of form controls, it is usually best to use a definition list <dl>. Define the label with <dt> and the control with <dd>.
• Never use a reset button. One mistaken click will cause the entire form to disappear!

CSS

CSS is used to define the presentation of a document, not the structure. Don't be afraid of CSS. It can make changing a lot of elements of a page a lot faster. It can also decrease the size of your output. It can also be used to change styles based on the user's interface.

• Use the BSD/Allman indentation style.
• Try to avoid inline styles and useless class names, such as bigred. Another user may decide that the text needs to be normal sized but bold and blue.
• Only use pseudo classes for links. Internet Explorer 6 and below don't support them.
• Use CSS shorthand as often as possible. Here is an excellent article on this subject from http://456BereaStreet.com.
• Do not do browser sniffing. The proper alternative is to use feature sniffing.
• If a value is 0, do not use a value type (px, em, etc).
• Box Model - This is where a correct doctype comes in.
  • IE < 6 uses IE box model.
  • IE >=6 uses W3C box model when a correct doctype is set.
• IE conditional comments may be necessary, but use them sparingly.

JavaScript

• Simple Machines JavaScript guidelines use the same indentation and whitespace guidelines as PHP.
• Never alter the prototype of Object.
• Avoid global objects. Use the var keyword in all functions. Put stuff in the smf namespace/object. Large mods can have their own namespace if they need to.
• Avoid eval(), including hidden ones. eval() is allowed in very specific situations, such as parsing JSON, but it shouldn't be used anywhere else. Hidden eval()s are something like onclick = "function();". Instead, just use onclick = function;.
• Don't browser detect. Instead, use feature detection. if possible, do feature detection outside of a function.
• Don't do calculations in the 2nd part of a for loop.
• Avoid the this keyword, because what it refers to can be unpredictable. Use it only in functions that will be run only by an event, when the alternative is messing around with the Event object.
• Avoid string concatenation. Instead, put groups of strings in an array and use the join() method.
• Use regular expressions – they're faster than most JavaScript string testing functions.
• Use object literal notations. It's quick and simple.

Security

Simple Machines prides itself on its security history and would like to keep it that way. Here are several guidelines to help keep security tight.

Are you my SMF?

The following is a simple, effective solution to make sure that a file is being used only on the intended system and only by SMF. It should appear at the very beginning of a file just after the copyright/license block. The output of die() may be changed, but it isn't recommended.

SMF Check Example

if (!defined('SMF'))
	die('Hacking attempt...');

Wash those variables!

There's no telling where they've been! Everything that comes from a user can be a potential security risk. After all, there is no way to tell if that user is a sweet old Granny or some crazed hacker bent on destroying the web site. All integers should be defined as integers before they are used. That includes array keys and values. Does that mean that every $_REQUEST variable has to be cast to an integer? No. That means that $_REQUEST variables that should be an integer must be cast to an integer.

Casting Example

$_GET['foo'] = (int) $_GET['foo'];
$bar = array (
	'my_fav' => (int) $_POST['bar]['my_fav'],
	'ghost' => (int) $_GET['boo'],
);

// (int) $var and settype($var, 'int') do the same thing.
$id_groundup = (int) $id_groundup;
$id_yo_momma = settype($id_yo_momma, 'int');

All variables being passed to the database must be escaped! This is a favorite exploit among hackers — SQL injection. Does that mean that every $_REQUEST variable should be escaped? Yes, but there is a solution for that. In QueryString.php, there is a function called cleanRequest(). It escapes all $_REQUEST variables at once. That means that $_REQUEST variables that are used in output need to be un-escaped with stripslashes().

The Permission System

Membergroups should not be hardcoded in order to give them special access. Use allowedTo() and isAllowedTo(), where allowedTo() is a basic check and isAllowedTo() is a check/error combination. Use boardsAllowedTo() to get a list of boards a user has a permission to.

Session checks

Before using input passed through a form from a user, their session should always be checked. Use validateSession() before actions in the administration center to ensure the user is who they say they are. Note that adminIndex() will do this.