# CodeSOD: The Big Family

DevFeed: [CodeSOD: The Big Family](<https://devfeed.tech/articles/codesod-the-big-family-28514.md>)

Original publisher: [Read original article](<https://thedailywtf.com/articles/the-big-family>)

Author: Remy Porter

Published: 2026-08-27T06:30:00Z

Content type: opinion

Language: en

Sources: [The Daily WTF](<https://devfeed.tech/sources/the-daily-wtf.md>)

Topics: [PHP](<https://devfeed.tech/topics/php.md>), [Programming](<https://devfeed.tech/topics/programming.md>), [Code](<https://devfeed.tech/topics/code.md>), [data](<https://devfeed.tech/topics/data.md>), [SQL](<https://devfeed.tech/topics/sql.md>), [Localization (l10n)](<https://devfeed.tech/topics/localization.md>), [formatting](<https://devfeed.tech/topics/formatting.md>), [HTML](<https://devfeed.tech/topics/html.md>), [Parsing](<https://devfeed.tech/topics/parsing.md>)

Tags: [array](<https://devfeed.tech/tags/array.md>), [code](<https://devfeed.tech/tags/code.md>), [codesod](<https://devfeed.tech/tags/codesod.md>), [fetch](<https://devfeed.tech/tags/fetch.md>), [formatting](<https://devfeed.tech/tags/formatting.md>), [html](<https://devfeed.tech/tags/html.md>), [humor](<https://devfeed.tech/tags/humor.md>), [php](<https://devfeed.tech/tags/php.md>), [programming](<https://devfeed.tech/tags/programming.md>), [sql](<https://devfeed.tech/tags/sql.md>)

## AI overview

This commentary examines a large, generalized PHP code sample that builds hierarchical output from a presumed database source. It highlights probable SQL injection risk, unused array keys, dynamic localization fields, extensive number formatting and HTML string manipulation, string-based date-time parsing, and repeated code for child and sibling records.

## Source excerpt

Some time ago, Charles shared with us some awful PHP, aka the most common sort. Today's code sample is maybe a little too big to sum up, but I'll let Charles take a crack at it. It's so bad that even analyzing and laughing at it feels impossible. But it's so bad, I couldn't not share it. I'm the only one handling all the IT-related tasks at my company, and I don't have anyone here to vent or laugh about this kind of thing with. So, I figured, why not share it here? I'm hoping it'll provide at least a little bit of catharsis or some dark humor. To make sure the confidentiality of the codebase was respected, I took the liberty of generalizing it. You might notice some inconsistencies, but that's just me trying to keep things neutral while protecting the original structure and functionality. Apologies if it looks a bit patchy - the goal was to avoid revealing any specific details or sensitive code. The whole block is north of 400 lines, and it's doing a lot. Or well, maybe it's not, as you'll see. Let's star with the outermost layer. $resm_data = $data_source->fetchData("group=" . $item_id); foreach ($resm_data as $key => $value) { // rest of the code here } We fetch data from a data source, presumably a database, passing our condition as a string, which reeks of probable SQL injection, but I don't know what library they're using. I also note they're using the key/value style of array iteration, but never actually check the key. $option_id = $value->option_id; $resm_details = $detail_source->fetch($option_id); if ($resm_details) { $label = $resm_details->{"label$lang"}; $description = $resm_details->{"description$lang"}; $category = $resm_details->category; Nice little bit of "meta" programming to get their localization working, it'll fetch labelen or labelde as needed. Definitely not a horrible, dangerous way to solve that problem. We use that again to get our currency figured out. That lets us do number formatting. So much number formatting code. if ($category == 0)