PHP MySQL Mini Projects for Beginners

Ten mini projects, ordered by what they teach

Work through these in order if you are starting out. Each project should take you from a few evenings to a couple of weekends, and each one reuses what the previous one taught.

1. Personal expense tracker — PHP, MySQL, PDO, HTML forms
   What you learn: the four basic operations of create, read, update and delete, plus SUM and GROUP BY to total spending by category and month. It is a single table with an obvious use, so all your attention stays on the fundamentals.
2. Contact form with an admin inbox — PHP, MySQL, PHPMailer optional
   What you learn: server-side validation, showing errors next to fields, keeping entered values after a failed submit, and redirecting after POST so that refreshing the page does not save the message twice.
3. Login and registration system — PHP sessions, password_hash, MySQL
   What you learn: sessions, password hashing, protecting pages behind a login, and a working logout. Build this one carefully, because you can reuse it in every project that follows.
4. Notes app with per-user data — PHP, MySQL foreign keys
   What you learn: foreign keys and ownership checks. The important lesson is that changing an id in the URL must not reveal another user's note, which is one of the most common bugs in real applications.
5. Blog with categories and pagination — PHP, MySQL JOIN, .htaccess rewrites
   What you learn: one-to-many relationships, JOIN queries, pagination using LIMIT and OFFSET, friendly URLs, and escaping user content on output.
6. Library book issue tracker — PHP, MySQL date functions
   What you learn: many-to-many data through a linking table, date arithmetic for due dates and fines, and queries that answer questions such as which books are overdue right now.
7. Image gallery with secure uploads — PHP GD, finfo, MySQL
   What you learn: handling file uploads safely, checking the real file type, generating new file names, creating thumbnails, and storing the file path in the database rather than the image itself.
8. Quiz app with scoring and timer — PHP, MySQL, JavaScript timer
   What you learn: storing related questions and options, reading dynamic form data, and calculating scores on the server, since anything calculated in the browser can be tampered with.
9. Live search for a product list — PHP JSON, MySQL indexes, fetch API
   What you learn: calling PHP from JavaScript with fetch, returning JSON, adding indexes to speed up search, and using EXPLAIN to see how MySQL runs your query.
10. Small shopping cart with orders — PHP, MySQL transactions, InnoDB
    What you learn: cart state in the session, transactions that save an order and its items together or not at all, and copying the price into the order so later price changes do not alter past orders.

A simple structure that scales

Keep a public folder that holds only the entry files and assets, and point your web server at it. Everything else sits outside the web root, where a browser cannot request it directly. That one decision means your database password can never be downloaded through a misconfigured URL.

• public: index.php, css, js and any public images.
• src: reusable functions or classes, including one single place that creates the database connection.
• templates: the HTML views, which should contain only display logic.
• config: database credentials and settings, kept out of Git and read from environment values or an untracked file.

Prepared statements: the fix for SQL injection

SQL injection happens when user input is pasted into a query string, so the database treats that input as part of the command. A prepared statement separates the two: you send the query with placeholders, then send the values separately, and the values can never change the structure of the query.

With PDO, write a query such as SELECT id, title FROM notes WHERE user_id = ?, call prepare, and pass the values to execute. Set PDO::ATTR_EMULATE_PREPARES to false and PDO::ATTR_ERRMODE to PDO::ERRMODE_EXCEPTION when you create the connection, so that you use native prepares and failures do not pass silently.

One limit catches beginners: placeholders only work for values, not for table or column names. If users can sort by a column, compare their choice with a fixed list of allowed column names and use the matching entry from your list. Do not build the ORDER BY clause from raw input.

Password hashing: never store what you can read back

Passwords should go through password_hash with PASSWORD_DEFAULT and be checked with password_verify. PHP generates a unique salt for you and stores it inside the hash, so you do not need a separate salt column. Make the column VARCHAR(255), because the default algorithm can change in future PHP versions and produce longer hashes.

Do not use md5 or sha1 for passwords, even though many old tutorials still do. They were designed to be fast, and fast is what an attacker wants. Password hashing functions are deliberately slow.

After a successful login, call session_regenerate_id(true) so that a session id known before login becomes useless. Show the same error message whether the email or the password was wrong, so your form does not reveal which accounts exist.

CSRF tokens: proving the request came from your form

Cross-site request forgery tricks a logged-in user's browser into sending a request to your site from somewhere else. The browser attaches the session cookie automatically, so without extra protection your application cannot tell the difference between that request and a real one.

The defence is short. Generate a token once per session with bin2hex(random_bytes(32)) and store it in the session. Include it as a hidden field in every form that changes data. On submit, compare the received value with the stored one using hash_equals, and reject the request if they differ. Also set the session cookie with SameSite=Lax, HttpOnly and, once you are on HTTPS, Secure.

This only protects actions sent by POST, so never change data through a GET link. A delete button should be a small form, not a plain link such as delete.php?id=5.

A security checklist for every mini project

• Every query that includes a variable uses a prepared statement.
• All user-supplied output passes through htmlspecialchars, which stops most cross-site scripting.
• Every page and action checks both that the user is logged in and that the record belongs to them.
• Uploads are limited by size, checked with finfo, renamed randomly and stored where they cannot run as PHP.
• Errors are logged on the live server, not shown to visitors; set display_errors to off in production.
• The application connects to MySQL with its own limited account rather than root.