TeamO Ranch — Farm & Agribusiness Website

Implementing a flexible product pricing model without a commerce framework required designing three separate price columns (price_live, price_dressed, price_processed) on the products table and building order-form logic that dynamically renders only the price options relevant to each product category. This kept the schema simple while supporting the farm real-world pricing structure where the same animal is sold at different prices depending on whether the buyer wants it live, field-dressed, or fully processed.

Without a payment gateway, the order workflow had to bridge the gap between online order placement and offline bank transfers. The solution was to generate a unique order number immediately on submission, email it to both the customer and admin, and give the admin a one-click status panel to manually advance the order through pending, processing, ready, and completed stages and flip the payment flag once funds cleared — keeping the process auditable without requiring real-time payment integration.

All security hardening that a framework would provide by default had to be implemented explicitly: PDO prepared statements with ATTR_EMULATE_PREPARES = false for true parameterisation, per-session CSRF tokens validated on every POST, bcrypt password hashing for admin accounts, HTTPOnly and cookie-only session configuration, file-upload MIME-type and size validation before storage, and a comprehensive .htaccess file that blocks direct config access, disables directory listing, adds HTTP security headers, and enforces browser caching and Gzip compression.

Deploy-time configuration management was solved with a dual-config pattern: a local config/config.php for development and a config/config.production.php template with clearly marked TODO placeholders for database credentials, SITE_URL, SITE_EMAIL, and SMTP settings. A Hostinger deployment guide documents the full go-live checklist — including folder permissions (755 for uploads, 644 for config) and the admin password reset procedure — so the site can be handed off to a non-technical owner.