LearnAI ToolsCareerPractice BuildsPlayDevelopmentContact
PHP ProgrammingIntermediate~2.5 hours

Blog CMS

Create, edit, and display blog posts stored in a database.

OOPPHP with MySQLForms

Overview

A blog CMS is the natural place to combine PHP's object-oriented syntax with real database access, because "create, read, update, delete a post" is exactly the kind of related behavior a class is meant to group together. Instead of writing SELECT, INSERT, UPDATE, and DELETE queries directly inside index.php, create.php, and edit.php — and inevitably writing slightly different versions of the same query more than once — this project wraps every database interaction behind a single Post class with one clearly named method per operation.

By the end of this tutorial you will have Post.php (the class), index.php (lists every post), create.php and edit.php (a shared form pattern for writing and changing a post), and delete.php (a POST-only deletion endpoint), all sharing one PDO connection from db.php. Every single value that comes from a visitor — a post id in the URL, a title or body typed into a form — reaches the database exclusively through a prepared statement's bound parameters, never concatenated directly into a SQL string, which is what makes SQL injection impossible against this code no matter what a visitor types.

What You'll Build
  • A posts MySQL table storing a title, body content, and created/updated timestamps.
  • A Post class wrapping every database interaction behind clearly named methods.
  • Prepared statements everywhere visitor input reaches SQL, so injection is not possible.
  • An index.php page listing every post with edit and delete links.
  • Create and edit forms that share the same layout and validate input before saving.
  • A delete action guarded by a confirmation prompt and executed through the class, not raw SQL on the page.

Prerequisites

  • OOP basics — defining a class with properties, a constructor, and methods.
  • PDO and prepared statements — binding parameters with ? instead of building SQL strings by hand.
  • MySQL basics — SELECT/INSERT/UPDATE/DELETE and an auto-increment primary key.
  • Forms and superglobals — reading $_POST for form submissions and $_GET for a post id in the URL.
  • Functions and includes — organizing a small multi-page project across several files with require_once.

Project Structure

The database connection lives in db.php, using the same PDO-with-exceptions pattern as the Login System project. Post.php defines the Post class, which receives that shared $pdo connection through its constructor rather than opening a second connection of its own — a small but important form of dependency injection that means every page in the project talks to the database through the exact same connection object. index.php, create.php, edit.php, and delete.php each handle exactly one page or action, and every one of them starts by requiring db.php and Post.php, then creating one new Post($pdo) to work with.

Step 1: Design the Posts Table

content is deliberately typed as TEXT rather than VARCHAR, since VARCHAR in MySQL has to declare a maximum length up front and a blog post can easily run past any reasonable limit you would pick. The updated_at column's ON UPDATE CURRENT_TIMESTAMP clause is a MySQL feature that refreshes that column automatically on every UPDATE, with no PHP code needed to set it manually each time a post is edited.

CREATE TABLE posts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(255) NOT NULL,
    content TEXT NOT NULL,                              -- TEXT, not VARCHAR: a post can run far past 255 characters
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
        ON UPDATE CURRENT_TIMESTAMP                     -- MySQL refreshes this automatically on every UPDATE
);

Step 2: Build the Post Class

The constructor takes the shared $pdo connection as a parameter instead of creating its own — this is dependency injection, and it means Post never has to know a hostname, username, or password, only how to use a connection it is handed. create() is the first method: title and content are bound through a prepared statement's ? placeholders rather than being woven into the query string, and lastInsertId() hands back the new row's auto-generated id, which callers can use to redirect straight to the new post.

<?php
class Post {
    private PDO $pdo;   // Every method reaches the database through this one shared connection


    public function __construct(PDO $pdo) {
        // Dependency injection: the class receives its PDO connection instead of opening
        // its own, so every page in the project shares the single connection from db.php.
        $this->pdo = $pdo;
    }


    public function create(string $title, string $content): int {
        // Prepared statement: title/content are bound as data, never concatenated into
        // the SQL string, which is exactly what makes this immune to SQL injection.
        $stmt = $this->pdo->prepare('INSERT INTO posts (title, content) VALUES (?, ?)');
        $stmt->execute([$title, $content]);
        return (int) $this->pdo->lastInsertId();   // Hand back the new post's id, e.g. to redirect straight to it
    }
}

Step 3: Read a Single Post and List All Posts

find() returns ?array — a nullable array — because a lookup by id can legitimately fail if the post was deleted or the id in the URL was simply wrong; returning null gives callers something explicit to check with === null, rather than having to remember that PDOStatement::fetch() itself returns false (not null) on no match. all() orders by created_at DESC so the newest writing always appears first, matching how every real blog's homepage behaves. Add both methods inside the Post class from Step 2, alongside create().

public function find(int $id): ?array {
    $stmt = $this->pdo->prepare('SELECT * FROM posts WHERE id = ?');
    $stmt->execute([$id]);
    $row = $stmt->fetch();
    return $row === false ? null : $row;   // fetch() returns false on no match; null reads more clearly to callers
}


public function all(): array {
    // Newest posts first, so a blog reader sees the most recent writing at the top of the list.
    $stmt = $this->pdo->query('SELECT * FROM posts ORDER BY created_at DESC');
    return $stmt->fetchAll();
}

Step 4: Update and Delete Posts

Both methods return a bool built from rowCount(), which reports how many rows the last statement actually affected — 0 if no row with that id existed, so callers can distinguish "the edit worked" from "there was nothing to edit" without a second query. Add both methods inside the Post class as well.

public function update(int $id, string $title, string $content): bool {
    $stmt = $this->pdo->prepare('UPDATE posts SET title = ?, content = ? WHERE id = ?');
    $stmt->execute([$title, $content, $id]);
    return $stmt->rowCount() > 0;   // rowCount() is 0 if no row matched that id, or nothing actually changed
}


public function delete(int $id): bool {
    $stmt = $this->pdo->prepare('DELETE FROM posts WHERE id = ?');
    $stmt->execute([$id]);
    return $stmt->rowCount() > 0;
}

Step 5: Build the Post List Page

index.php calls $post->all() and loops the results with foreach, truncating each post's body to a short preview with substr() so the list stays scannable. The delete link is deliberately a small <form> that submits a POST request rather than a plain <a href="delete.php?id=...">, because a GET link can be triggered accidentally — by a browser prefetching links, or even by a malicious <img> tag embedded on another page — while a POST only fires in response to an actual form submission, which the confirm() popup in onclick gives the visitor one last chance to cancel.

index.php
<?php
require_once 'db.php';
require_once 'Post.php';


$post = new Post($pdo);
$posts = $post->all();
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>Blog</title></head>
<body>
    <h1>Blog Posts</h1>
    <a href="create.php">+ New Post</a>


    <?php foreach ($posts as $row): ?>
        <article>
            <h2><?= htmlspecialchars($row['title']) ?></h2>
            <p><?= nl2br(htmlspecialchars(substr($row['content'], 0, 200))) ?>...</p>
            <a href="edit.php?id=<?= (int) $row['id'] ?>">Edit</a>
            <form action="delete.php" method="POST" style="display:inline">
                <input type="hidden" name="id" value="<?= (int) $row['id'] ?>">
                <button type="submit" onclick="return confirm('Delete this post?')">Delete</button>
            </form>
        </article>
    <?php endforeach; ?>
</body>
</html>

Step 6: Build the Create and Edit Forms

create.php and edit.php share nearly identical bodies — read $_POST on submit, validate, save, redirect — with one meaningful difference: edit.php first loads the existing post with find() using the id from $_GET, and uses its title and content to pre-fill the form on the first (non-POST) visit. delete.php has no form of its own at all; it only ever accepts the POST request sent by the delete button built in Step 5, deletes that post through the class, and redirects straight back to the list.

create.php
<?php
require_once 'db.php';
require_once 'Post.php';


$errors = [];
$title = $content = '';


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $title   = trim($_POST['title'] ?? '');
    $content = trim($_POST['content'] ?? '');


    if ($title === '' || $content === '') {
        $errors[] = 'Both title and content are required.';
    } else {
        $post = new Post($pdo);
        $post->create($title, $content);
        header('Location: index.php');   // Back to the list, where the new post now appears first
        exit;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>New Post</title></head>
<body>
    <h1>New Post</h1>


    <?php foreach ($errors as $error): ?>
        <p style="color: red;"><?= htmlspecialchars($error) ?></p>
    <?php endforeach; ?>


    <form action="" method="POST">
        <label for="title">Title</label><br>
        <input type="text" id="title" name="title" value="<?= htmlspecialchars($title) ?>"><br>


        <label for="content">Content</label><br>
        <textarea id="content" name="content" rows="10"><?= htmlspecialchars($content) ?></textarea><br>


        <button type="submit">Publish</button>
    </form>
</body>
</html>
edit.php
<?php
require_once 'db.php';
require_once 'Post.php';


$post = new Post($pdo);
$id = (int) ($_GET['id'] ?? 0);
$existing = $post->find($id);


if ($existing === null) {
    http_response_code(404);
    die('Post not found.');
}


$errors = [];
$title = $existing['title'];
$content = $existing['content'];


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $title   = trim($_POST['title'] ?? '');
    $content = trim($_POST['content'] ?? '');


    if ($title === '' || $content === '') {
        $errors[] = 'Both title and content are required.';
    } else {
        $post->update($id, $title, $content);
        header('Location: index.php');
        exit;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>Edit Post</title></head>
<body>
    <h1>Edit Post</h1>


    <?php foreach ($errors as $error): ?>
        <p style="color: red;"><?= htmlspecialchars($error) ?></p>
    <?php endforeach; ?>


    <form action="" method="POST">
        <label for="title">Title</label><br>
        <input type="text" id="title" name="title" value="<?= htmlspecialchars($title) ?>"><br>


        <label for="content">Content</label><br>
        <textarea id="content" name="content" rows="10"><?= htmlspecialchars($content) ?></textarea><br>


        <button type="submit">Save Changes</button>
    </form>
</body>
</html>
delete.php
<?php
require_once 'db.php';
require_once 'Post.php';


// POST-only on purpose: a GET-triggered delete link could be followed accidentally
// (or triggered by something like an <img> tag on another page), so deletion only
// ever happens in response to the confirmed form submit built in Step 5.
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $id = (int) ($_POST['id'] ?? 0);
    $post = new Post($pdo);
    $post->delete($id);
}


header('Location: index.php');
exit;

Complete Code

Here is the full Post class with every method from Steps 2-4 assembled together, plus the four page scripts that use it.

Post.php
<?php
class Post {
    private PDO $pdo;


    public function __construct(PDO $pdo) {
        $this->pdo = $pdo;
    }


    public function create(string $title, string $content): int {
        $stmt = $this->pdo->prepare('INSERT INTO posts (title, content) VALUES (?, ?)');
        $stmt->execute([$title, $content]);
        return (int) $this->pdo->lastInsertId();
    }


    public function find(int $id): ?array {
        $stmt = $this->pdo->prepare('SELECT * FROM posts WHERE id = ?');
        $stmt->execute([$id]);
        $row = $stmt->fetch();
        return $row === false ? null : $row;
    }


    public function all(): array {
        $stmt = $this->pdo->query('SELECT * FROM posts ORDER BY created_at DESC');
        return $stmt->fetchAll();
    }


    public function update(int $id, string $title, string $content): bool {
        $stmt = $this->pdo->prepare('UPDATE posts SET title = ?, content = ? WHERE id = ?');
        $stmt->execute([$title, $content, $id]);
        return $stmt->rowCount() > 0;
    }


    public function delete(int $id): bool {
        $stmt = $this->pdo->prepare('DELETE FROM posts WHERE id = ?');
        $stmt->execute([$id]);
        return $stmt->rowCount() > 0;
    }
}
index.php
<?php
require_once 'db.php';
require_once 'Post.php';


$post = new Post($pdo);
$posts = $post->all();
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>Blog</title></head>
<body>
    <h1>Blog Posts</h1>
    <a href="create.php">+ New Post</a>


    <?php foreach ($posts as $row): ?>
        <article>
            <h2><?= htmlspecialchars($row['title']) ?></h2>
            <p><?= nl2br(htmlspecialchars(substr($row['content'], 0, 200))) ?>...</p>
            <a href="edit.php?id=<?= (int) $row['id'] ?>">Edit</a>
            <form action="delete.php" method="POST" style="display:inline">
                <input type="hidden" name="id" value="<?= (int) $row['id'] ?>">
                <button type="submit" onclick="return confirm('Delete this post?')">Delete</button>
            </form>
        </article>
    <?php endforeach; ?>
</body>
</html>
create.php
<?php
require_once 'db.php';
require_once 'Post.php';


$errors = [];
$title = $content = '';


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $title   = trim($_POST['title'] ?? '');
    $content = trim($_POST['content'] ?? '');


    if ($title === '' || $content === '') {
        $errors[] = 'Both title and content are required.';
    } else {
        $post = new Post($pdo);
        $post->create($title, $content);
        header('Location: index.php');
        exit;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>New Post</title></head>
<body>
    <h1>New Post</h1>


    <?php foreach ($errors as $error): ?>
        <p style="color: red;"><?= htmlspecialchars($error) ?></p>
    <?php endforeach; ?>


    <form action="" method="POST">
        <label for="title">Title</label><br>
        <input type="text" id="title" name="title" value="<?= htmlspecialchars($title) ?>"><br>


        <label for="content">Content</label><br>
        <textarea id="content" name="content" rows="10"><?= htmlspecialchars($content) ?></textarea><br>


        <button type="submit">Publish</button>
    </form>
</body>
</html>
edit.php
<?php
require_once 'db.php';
require_once 'Post.php';


$post = new Post($pdo);
$id = (int) ($_GET['id'] ?? 0);
$existing = $post->find($id);


if ($existing === null) {
    http_response_code(404);
    die('Post not found.');
}


$errors = [];
$title = $existing['title'];
$content = $existing['content'];


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $title   = trim($_POST['title'] ?? '');
    $content = trim($_POST['content'] ?? '');


    if ($title === '' || $content === '') {
        $errors[] = 'Both title and content are required.';
    } else {
        $post->update($id, $title, $content);
        header('Location: index.php');
        exit;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>Edit Post</title></head>
<body>
    <h1>Edit Post</h1>


    <?php foreach ($errors as $error): ?>
        <p style="color: red;"><?= htmlspecialchars($error) ?></p>
    <?php endforeach; ?>


    <form action="" method="POST">
        <label for="title">Title</label><br>
        <input type="text" id="title" name="title" value="<?= htmlspecialchars($title) ?>"><br>


        <label for="content">Content</label><br>
        <textarea id="content" name="content" rows="10"><?= htmlspecialchars($content) ?></textarea><br>


        <button type="submit">Save Changes</button>
    </form>
</body>
</html>
delete.php
<?php
require_once 'db.php';
require_once 'Post.php';


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $id = (int) ($_POST['id'] ?? 0);
    $post = new Post($pdo);
    $post->delete($id);
}


header('Location: index.php');
exit;

Sample Run

Sample Run

Click Run to see what this code prints.

Extend This Project

  • Add pagination to index.php (e.g. LIMIT/OFFSET) once the posts table grows past a single screenful.
  • Add a slug column and rewrite URLs to /blog/my-post-title instead of edit.php?id=....
  • Add a published boolean column so drafts can be saved without appearing on the public list.
  • Add simple category or tag support with a second table and a join query in Post::all().
  • Store the currently logged-in author's id on each post (combine with the Login System project) so multiple authors can share one CMS.

Summary

You built a small content management system the way real PHP applications structure database access: every SELECT, INSERT, UPDATE, and DELETE lives inside one Post class behind a clearly named method, and every value that comes from a visitor reaches SQL only through a prepared statement's bound parameters. That combination — a class owning its own data access, plus prepared statements everywhere user input meets a query — is the foundation almost every larger PHP application, whether hand-rolled or framework-based, builds on top of.

More PHP Programming Practice Builds

Beginner

Contact Form Handler

Validate and process form submissions with email notifications.

Build This →Intermediate

Login System

Build authentication with sessions and password hashing.

Build This →Intermediate

Shopping Cart

Build a session-based cart that persists across pages.

Build This →