Carlton Haas builds systems that keep running for years, not just demos.

What I did

Wrote the validating PHP endpoint (server-side email format checks, duplicate detection), designed the tbl_email_list schema, and wired both the modal and a second footer form into the same table so the two signup paths can't fragment into separate lists. Added a branded HTML confirmation email sent through a bundled SMTP mailer, with the send failure path logged instead of silently swallowed.

Stack used

What I did

Ported the theme's remaining mysql_* calls (removed in PHP 7.0) to mysqli across five form-submit files and the session-tracking code that runs on every page load. Found each() (removed in PHP 8.0) inside the bundled SMTP mailer's auth-detection logic — quietly fataling and breaking every outgoing email — then replaced the old mailer with one shared PHPMailer-based mailer used by all my client sites. Fixed a newsletter sign-up that returned a 500 and never sent its welcome email, and closed a SQL injection where the session cookie was pasted straight into a query.

Moved the database, mail and WordPress credentials out of the web root into a server-side config folder the site loads through small password-free stubs, with a loader that refuses a misplaced copy and logs exactly what's missing. Also tracked down a one-line path bug where a sibling include resolved relative to the wrong directory, which had worked by coincidence until a new include exposed it as a fatal error on every page.

Stack used

What I did

Upgraded WordPress from 4.0.1 to 7.1.2 and brought the custom theme up to PHP 8.4. Found and closed a login flaw where a pharmacist's session was created before the password was checked — knowing a pharmacist's email was enough to get in. Moved passwords from salted SHA-1 to password_hash(), re-hashing each account on its next login so no customer had to reset, and made reset tokens random, hashed and https-only.

Converted every request-driven query (refills, insurance, family members, account settings) to prepared statements, filtered the JSONP callback, and fixed mixed-content blocking, a logout 404 and a registration flow broken by hand-built JSON. The site is now covered by the daily automated checks below.

Stack used

What I did

Moved every page from Ext JS 2.2 to 3.3.1, fixing a registration page that crashed outright and turning registration into an in-page dialog. Hardened the back end: password_hash() with transparent upgrade of the old salted SHA-1 hashes, hashed reset codes, prepared statements for login, registration and every request-driven query, CSRF tokens on every form handler, and database or mail errors no longer shown to visitors.

Brought the mailer and the rest of the PHP up to 8.4, and cleared the warnings that were logged on every login and search.

Stack used

What I did

Wrote a cron-driven checker that uses each site the way a visitor would, every morning. It logs dedicated test accounts in and out, confirms members-only pages turn visitors away and customers can't reach the pharmacist tools, and posts deliberately mismatched forms that every handler must refuse, so nothing is ever saved or emailed.

It also checks every linked stylesheet, script and image, connects to each database and counts key tables, reads only the new lines of each PHP error log since the last run, and warns before a certificate expires. It emails a report only when something fails or recovers, plus a weekly all-clear. Its first runs turned up broken image, stylesheet and document links and PHP warnings on two sites, all since fixed.

Stack used