Home >AI >Coding with AI >How to review code written by AI

How to review code written by AI

Code from AI often works at first glance. That does not mean it is secure, correct in all cases and a good fit for the project. A checklist of what to go through in generated PHP code before you use it.

1. Does the code really do what it should?

Read all of it and make sure you understand it.
Try normal input as well as edge cases: an empty value, zero, accented letters, very long text, an invalid format.
Check that the functions used exist and that the order of the parameters is right (php.net).

2. Security

SQL queries – values from the user only through prepared statements (mysqli or PDO), never by building a string.
Output to HTML – escape text from the user with the htmlspecialchars() function with the ENT_QUOTES flag.
Including files – never include or require based on a value from the URL; allowed values only from a list (whitelist).
Passwords – store them with password_hash() and verify them with password_verify(), never as MD5 or SHA1.
File uploads – check the type and size and save the file under your own name.
Credentials – passwords and API keys do not belong in the code but in a configuration outside the public folder of the website.
Forms in the admin – protection with a CSRF token.

3. Does the code fit the project?

Will it run on your PHP version? AI often uses newer syntax, for example the match expression or the ?-> operator from PHP 8 on a server with PHP 7.4.
Does it follow the conventions of the project (database connection, encoding, naming)?
Does it add an unnecessary library or dependency?
Did it change code it should not have changed? Compare the changes, for example with the git diff command.

4. Errors and unexpected states

What happens when the database connection fails or a query returns no rows?
Does the code show visitors detailed error messages (file paths, SQL queries)?
Does it write sensitive data to the log, for example entered passwords?

Example: a common error in code from AI

// WRONG – a value from the URL directly in the SQL query (SQL injection)
$id = $_GET["id"];
$result = mysqli_query($db, "SELECT title FROM articles WHERE id = " . $id);
// RIGHT – a prepared statement, the value is sent separately from the query
$stmt = mysqli_prepare($db, "SELECT title FROM articles WHERE id = ?");
mysqli_stmt_bind_param($stmt, "i", $_GET["id"]);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $title);
if (mysqli_stmt_fetch($stmt)) {
  echo htmlspecialchars($title, ENT_QUOTES, "UTF-8");
}
mysqli_stmt_close($stmt);

It is also useful to have the code reviewed in a new conversation (or by another model) with a specific prompt, for example “find security bugs and bugs in edge cases”. It does not replace your own review, but it often finds something extra.