OMGTube PHP Video Portal — Technical Case Study

Project at a glance

Evidence and provenance boundary

Delivered for a private client; client identity is not disclosed. Technical claims on this page are limited to the current public repository. That source does not establish client satisfaction, publication permission, production deployment, commercial value, traffic, scale, uptime, or measurable business results.

Application architecture

The public path combines Apache, PHP-rendered markup, Bootstrap, and browser JavaScript. Search and pagination values cross a POST boundary to a PHP endpoint, prepared mysqli queries read the relational model, and JSON records are appended as browser cards. Playback remains an external embed boundary rather than locally hosted video media.

MySQL content model

The inspected schema separates administrative identities, categories, video records, tags, and their many-to-many association. The table below summarizes structure without reproducing seeded users or configuration values.

Search and incremental-loading workflow

1. 1The browser submits the current page, search text, and category through FormData.
2. 2load_more_videos.php builds active-record filters and binds search, category, offset, and limit values to prepared statements.
3. 3Each request is bounded to 18 records and returns video fields plus a has_more flag as JSON.
4. 4The browser appends cards, increments the page when more records remain, and requests again near the bottom of the document.
5. 5The current scroll listener uses an approximately 1,000-pixel threshold before the page bottom.

This proves incremental application behavior. It does not provide a speed, scalability, throughput, latency, or user-experience benchmark. The public listing also lacks an explicit zero-result message after an empty search response.

Apache routing and clean-URL limitations

The root Apache rule maps /video/{category}/{slug} to watch.php, where a prepared query looks up an active record by normalized category and title values. Routing evidence is incomplete, however: homepage cards open a JavaScript modal, and at least one related-video path uses a value that does not align with the category segment expected by the rewrite contract. The source therefore demonstrates a route boundary, not fully reliable clean-URL behavior.

Admin add, edit, and delete workflow

Thumbnail and embed boundaries

YouTube records derive thumbnails from img.youtube.com. TikTok records may use a locally uploaded thumbnail, while other cases can fall back to a generic visual. The upload helper checks that the temporary file is an image, limits size to 2 MB, allows selected image extensions, and generates a new filename before moving the file. YouTube, TikTok, and Facebook are the evidenced embed boundaries.

These checks do not establish comprehensive upload security. Stronger MIME validation, isolated storage, execution restrictions, retention rules, and privacy review are not demonstrated by the current public source. Automated collection or importing is not claimed.

Authentication versus authorization

Implemented controls

These are specific source observations, not a statement that the application is secure.

• Prepared statements across major data paths
• Integer casting for record and category identifiers
• Supported-platform URL and identifier extraction
• Password hashing and verification
• Selected htmlspecialchars output encoding
• Image inspection, size limits, and extension checks
• Transactions around multi-step content changes
• Apache directory listing disabled

Security and repository-hygiene findings

The historical implementation has useful boundaries, but it also records why public source must be reviewed before it becomes portfolio evidence. The current tree does not establish CSRF protection, consistent output encoding, session-ID rotation, hardened cookie policy, a centralized CSP or security-header strategy, formal validation, automated tests, or structured logging.

• Returned JSON values are used to construct HTML and need stricter encoding discipline.
• Some database-backed values are printed directly in public and administrative views.
• A GET-based delete path and other state-changing forms have no evidenced CSRF token.
• Wildcard CORS and deployment-specific route paths need environment-aware review.
• Literal database configuration should move to managed environment configuration outside an isolated public root.
• Seed, default-login, and administrative-utility material should be removed or restricted before portfolio reuse.

No database value, seeded identity, default credential, reset detail, or private deployment value is reproduced here. This review identifies categories requiring cleanup; it does not assert that an active production secret was verified.

Safe source excerpts

These small excerpts preserve architectural provenance without including configuration, seed data, credentials, administrative reset behavior, or private deployment values.

Apache route boundary

.htaccess

RewriteEngine On
RewriteRule ^video/([^/]+)/([^/]+)/?$ watch.php?category=$1&slug=$2 [L,QSA]

Options -Indexes

Demonstrates a rewrite and directory-listing boundary; it does not prove complete routing reliability or Apache security.

Prepared pagination boundary

load_more_videos.php

$stmt = $conn->prepare($query);
$params[] = $offset;
$params[] = $per_page;
$types .= 'ii';
$stmt->bind_param($types, ...$params);
$stmt->execute();

Demonstrates bound pagination parameters; it does not establish measured query speed or production-scale behavior.

Transactional content insert

admin/add_video.php

$conn->begin_transaction();
$query = "INSERT INTO videos
  (title, source, video_id, thumbnail, category_id, status)
  VALUES (?, ?, ?, ?, ?, ?)";
$stmt = $conn->prepare($query);
$stmt->bind_param("ssssss", $title, $source, $video_id, $thumbnail, $category_id, $status);

Demonstrates a prepared write inside a transaction boundary; it does not establish complete validation, authorization, or recovery behavior.

Many-to-many tag schema

database/db.sql — schema only

CREATE TABLE video_tags (
  video_id INT NOT NULL,
  tag_id INT NOT NULL,
  PRIMARY KEY (video_id, tag_id),
  FOREIGN KEY (video_id) REFERENCES videos(id) ON DELETE CASCADE,
  FOREIGN KEY (tag_id) REFERENCES tags(id) ON DELETE CASCADE
);

Demonstrates relational tag associations and delete behavior; it does not reveal or establish the size of any production dataset.

Error and failure boundaries

What the evidence demonstrates

What I would harden next

Recommendations — not historical implementation claims

• Add CSRF tokens and use POST or DELETE semantics for state-changing actions.
• Move secrets into managed environment configuration outside an isolated public root.
• Enforce explicit role authorization, session rotation, and hardened cookie settings.
• Apply contextual output encoding and safe DOM construction consistently.
• Remove or restrict administrative utilities, seed guidance, and default-access material.
• Store uploads outside executable paths with MIME verification and retention rules.
• Replace deployment-specific paths with one validated base-URL configuration.
• Add CSP and modern security headers, automated tests, structured logging, and CI hygiene checks.

What this project demonstrates

The public source demonstrates a conventional PHP web application spanning relational modeling, prepared database access, incremental browser requests, Apache rewriting, external embed boundaries, session-based administration, transactional writes, and visible historical hardening opportunities. Its portfolio value comes from those inspectable boundaries—not from unsupported performance or business claims.