Flatbb – free open-source PHP forum for cheap VPS/shared hosting, built to be extended with AI

nwnuyhs

I've just released Flatbb 0.1.4, a flat, lightweight forum written in plain PHP 8.1. MIT licensed, free forever.

Why LES folks might like it:

• No framework, no Composer, no build step. Upload, open the installer, done in 2 minutes. Runs happily on the cheapest shared hosting or a 1 GB VPS.
• SQLite or MySQL 5.7+. Start on SQLite, move to MySQL later with one command.
• Built for AI-assisted development. The repo ships CLAUDE.md / AGENTS.md and docs written for AI tools. Open the folder in Claude Code or Cursor, say "add a badge plugin", and it knows the hooks, the rules and how to publish.
• Plugin marketplace with one-click install from the admin panel; publish your own plugin with php flatbb plugin:publish.
• Discourse-style three-column layout, dark mode, Markdown editor with image upload, full-text search, 7 interface languages.

Download: https://www.flatbb.com/download · Plugins: https://www.flatbb.com/market

It's early (0.1.x) and I'd love feedback, bug reports and plugin ideas.

nwnuyhs

Update: the source is now on GitHub (MIT): https://github.com/nwnuyhs/flatbb — and 0.1.5 is out with the security changes people asked for (CSRF verified centrally for every POST, a static check that fails on unescaped template output or direct $_POST reads). Download page: https://www.flatbb.com/download

mikho

Interesting project. Doing some (read: a lot) of AI coding myself lately… There is a whole thread about a really large project, completely coded with Claude.

I'm curious why the people who downvoted your post did so.

nwnuyhs

@mikho said:
Interesting project. Doing some (read: a lot) of AI coding myself lately… There is a whole thread about a really large project, completely coded with Claude.

I'm curious why the people who downvoted your post did so.

thanks for your understand , it's a new generation forum product , I think one day someone will find the value of this kind of product

WSS

If it was 2004 again, I'd be all over this. I might give it a poke later, but forums are kind of- a thing of the past, sadly.

truemagic

I really love what I see,might try it soon! Thanks for the contribution

nwnuyhs

@truemagic said:
I really love what I see,might try it soon! Thanks for the contribution

You are welcome ，you can try，and use ai build the plugin what you want

Fritz

Upvoted.
I like it. Light and simple.

rm_

@nwnuyhs said: SQLite or MySQL 5.7+. Start on SQLite, move to MySQL later with one command.

From the name I thought it would be flat file based, that is storing all data in plain files on disk, not using any SQL (not even SQLite). That was the big thing back in the day, when the cheapest web hosting plans didn't come with any SQL support.

Not_Oles

@nwnuyhs said:
Update: the source is now on GitHub (MIT): https://github.com/nwnuyhs/flatbb — and 0.1.5 is out with the security changes people asked for (CSRF verified centrally for every POST, a static check that fails on unescaped template output or direct $_POST reads). Download page: https://www.flatbb.com/download

Where is the security and other change discussion happening? Thanks!

nwnuyhs

@rm_ said:

@nwnuyhs said: SQLite or MySQL 5.7+. Start on SQLite, move to MySQL later with one command.

From the name I thought it would be flat file based, that is storing all data in plain files on disk, not using any SQL (not even SQLite). That was the big thing back in the day, when the cheapest web hosting plans didn't come with any SQL support.

Not that , it's based on php + myslq 5.7+ or sqlite

nwnuyhs

@Not_Oles said:

@nwnuyhs said:
Update: the source is now on GitHub (MIT): https://github.com/nwnuyhs/flatbb — and 0.1.5 is out with the security changes people asked for (CSRF verified centrally for every POST, a static check that fails on unescaped template output or direct $_POST reads). Download page: https://www.flatbb.com/download

Where is the security and other change discussion happening? Thanks!

thanks for your love , people talk here : https://www.reddit.com/r/PHP/comments/1w6zj1e/comment/p7qx4ku/
In addition , can you give me a star on github : https://github.com/nwnuyhs/flatbb

aphs

CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0,

Wow, what kind of LLM would write something like this

The /post endpoints also do not call and block on category_can_view() so users can see posts in hidden categories?

Plugins execute immediately due to an include() even if they are not enabled??

nwnuyhs

@aphs said:

CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0,

Wow, what kind of LLM would write something like this

The /post endpoints also do not call and block on category_can_view() so users can see posts in hidden categories?

Plugins execute immediately due to an include() even if they are not enabled??

This is a new system, so a few bugs are to be expected. Thanks for the feedback—I'll have this fixed in the next version.

nwnuyhs

@aphs said:

CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0,

Wow, what kind of LLM would write something like this

The /post endpoints also do not call and block on category_can_view() so users can see posts in hidden categories?

Plugins execute immediately due to an include() even if they are not enabled??

Fixed https://www.flatbb.com/download

aphs

For manifest, this is typically why most are designed in a manner that either the manifest is parsed out of comments at the top of the file, or there is a plugin.json next to the actual executable so it reads that instead in a safe manner.

nwnuyhs

@aphs said:

For manifest, this is typically why most are designed in a manner that either the manifest is parsed out of comments at the top of the file, or there is a plugin.json next to the actual executable so it reads that instead in a safe manner.

Thanks, that is a fair way to put it. Since 0.1.12 disabled plugins are never executed: the manifest is read from the file text (the return [...] block at the end of plugin.php) without including it, and only enabled plugins are loaded. Same safety goal as a plugin.json, without changing the plugin format that existing plugins, the marketplace checks and the AI docs rely on. If the format ever moves, the likely path is having plugin:package write a plugin.json into the zip automatically, so authors do not need to change anything. Appreciate you looking this closely.

Not_Oles

@nwnuyhs said:

@Not_Oles said:

@nwnuyhs said:
Update: the source is now on GitHub (MIT): https://github.com/nwnuyhs/flatbb — and 0.1.5 is out with the security changes people asked for (CSRF verified centrally for every POST, a static check that fails on unescaped template output or direct $_POST reads). Download page: https://www.flatbb.com/download

Where is the security and other change discussion happening? Thanks!

thanks for your love , people talk here : https://www.reddit.com/r/PHP/comments/1w6zj1e/comment/p7qx4ku/

Thanks for the link. Will read today!

In addition , can you give me a star on github : https://github.com/nwnuyhs/flatbb

Of course! . . .

aphs

@nwnuyhs said: Thanks, that is a fair way to put it. Since 0.1.12 disabled plugins are never executed: the manifest is read from the file text (the return [...] block at the end of plugin.php) without including it, and only enabled plugins are loaded. Same safety goal as a plugin.json, without changing the plugin format that existing plugins, the marketplace checks and the AI docs rely on. If the format ever moves, the likely path is having plugin:package write a plugin.json into the zip automatically, so authors do not need to change anything. Appreciate you looking this closely.

Its early enough and few enough that you should just break it, if there is no plugin.json then just show the folder name and no other info.

Using regex or trying to stripos \nreturn is a terrible, rapidly breaking idea. Ask a paid high effort LLM why this is.

nwnuyhs

@aphs said: Its early enough and few enough that you should just break it, if there is no plugin.json then just show the folder name and no other info. Using regex or trying to stripos \nreturn is a terrible, rapidly breaking idea.

You are right that the regex is the weak part, so I am replacing it rather than defending it. The manifest will be read with PHP's tokenizer (token_get_all): literals and constants only, anything else counts as unreadable and the plugin shows up as its folder name, exactly as you suggest. Once a plugin is enabled its manifest is cached in the database, so the file is not parsed on every request. The marketplace runs the same parser on uploads, so nothing gets executed there either.

I am keeping the return [...] array instead of a separate plugin.json for one reason: a plugin stays one file with one source of truth, which is what makes one-sentence AI-generated plugins reliable. plugin:package will write a plugin.json into the zip as a by-product for tools that want it. Thanks for pushing on this.

Not_Oles

What's up with FlatBB? Thanks!

1. FlatBB Github source repo 404s.

2. nwnuyhs Github account still present, but without the flatbb repository.

3. flatbb.com website still up.

4. Website source downloads are restricted to members.

mikho

@Not_Oles said:
What's up with FlatBB? Thanks!

1. FlatBB Github source repo 404s.

2. nwnuyhs Github account still present, but without the flatbb repository.

3. flatbb.com website still up.

4. Website source downloads are restricted to members.

Maybe moved to a private repo?

nwnuyhs

@Not_Oles said: What's up with FlatBB? Thanks!

Thnaks for your atention.
The github code I published find some problem , I need some time to complete it , now i am develop on local. the github will be available soon
But don't worry , the project is alive , you can download the new code here : https://www.flatbb.com/download (now need login , later will open for everyone)
And you can see , I have developed several plugins , it's a open scource proje , I try my best to make this project light and simplely ,I wish more people can join the develop ，and communicate with me about the details ,and fix bugs .
that's all.

dbadude

i forked it before the retreat. I like it, i think its good enough for a backend for a cms system.

nwnuyhs

@dbadude said:
i forked it before the retreat. I like it, i think its good enough for a backend for a cms system.

you can download the new pagekage here : https://www.flatbb.com/download

the github will be live later

legendary

Ou boy, those "The github code I published find some problem" will bite someone in their ass so hard . Imagine you garner some community using this application and then "some problem"...

nwnuyhs

@legendary said:
Ou boy, those "The github code I published find some problem" will bite someone in their ass so hard . Imagine you garner some community using this application and then "some problem"...

thnaks for your feedback , we have republished the code to Github . the probelm has solved.
now ，everything woks well , the new verion now is available in github ：https://github.com/nwnuyhs/flatbb

also , we make a big update ,include security ，new feature , RTL , ui , ux , ue , etc , invite you to experience ：https://www.flatbb.com/

many plugin now live : https://www.flatbb.com/c/plugins

And now you can send this docs to AI to develope any pluin you want : https://www.flatbb.com/dev/plugins

Falzo

what is your relation to https://bbs1.org/ ?

is this a fork or reboot? if so, why isn't it mentioned?

and what's with that fixation on plugins? is that a thing?

nwnuyhs

@Falzo said:
what is your relation to https://bbs1.org/ ?

is this a fork or reboot? if so, why isn't it mentioned?

and what's with that fixation on plugins? is that a thing?

Flatbb is a new project, not fork or reboot others ,the flatbb code is open in Github，you can compare code and structure.the code will tell you the answer.
About the plugin，it's trend now in most development project，for example: flarum，discourse,wordpress
we are willing hear the ideas and critical from users，thanks again

Not_Oles

@nwnuyhs said: we have republished the code to Github . the probelm has solved

Hi @nwnuyhs! What was the problem? What was the commit which fixed the problem? Thanks! Tom

dbadude

@Not_Oles said:

@nwnuyhs said: we have republished the code to Github . the probelm has solved

Hi @nwnuyhs! What was the problem? What was the commit which fixed the problem? Thanks! Tom

Wow i see 75 new commits @nwnuyhs how much money did that cost at antropic?
You use a pro account there?

Fritz

@nwnuyhs would be great if you can create docker version.

NodeSuper

That's really good.

nwnuyhs

@Not_Oles said:

@nwnuyhs said: we have republished the code to Github . the probelm has solved

Hi @nwnuyhs! What was the problem? What was the commit which fixed the problem? Thanks! Tom

The problem I was referring to was a functional bug I discovered. Subsequent updates have since fixed and improved the functionality. You can find the complete changelog at https://www.flatbb.com/download.
The latest package V0.1.58 was released on GitHub today：https://github.com/nwnuyhs/flatbb/releases
seo PRO PLUGIN comes with the new version :https://www.flatbb.com/t/seo-pro-seo-pro-48#post-183

calibernode

Would love to add this to our apps catalog with permission of course.

Possibly add docker support?

Thanks

nwnuyhs

@calibernode said:
Would love to add this to our apps catalog with permission of course.

Possibly add docker support?

Thanks

Yes , docker is in our update roadmap

nwnuyhs

@calibernode said:
Would love to add this to our apps catalog with permission of course.

Possibly add docker support?

Thanks

docker is available now : https://github.com/nwnuyhs/flatbb/blob/main/docs/DOCKER.md