Database evidence - Me2You submission hub

What this page shows

Evidence for the D2 MySQL screenshots requirement. Every Me2You table is listed below, grouped by domain. The migration story explains how a new clone goes from empty to fully seeded with one shell command. The screenshot slots are ready for phpMyAdmin captures.

Overview metrics
All 62 tables by domain
Migration story (44 files)
Seed story (10 files, 38 listings)
Security story
phpMyAdmin screenshots

Overview metrics

62tablesAcross 9 domains
44migrationsOrdered numerically
10seed filesDemo data only
38demo listingsAcross 27 categories
27categoriesTree, self-referencing
9cron jobsEscrow, auctions, reminders

All 62 tables by domain

Users and access (10)

Identity, addresses, sessions, follows, verifications, blocks, reports, terms acceptance, settings, subscriptions.

users
addresses
password_resets
terms_acceptances
user_verifications
user_reports
user_blocks
follows
settings
subscriptions

Catalogue (10)

Listings, their image and video media, comments, reactions, categories tree, vertical-specific deep fields (properties, vehicles), import staging, geocode cache.

categories
listings
listing_images
listing_media
listing_comments
listing_reactions
listing_imports
properties
vehicles
geocode_cache

Cart, orders and escrow (8)

One cart per user, line items, saved-for-later, orders and items, escrow ledger, refund requests, payment audit.

carts
cart_items
cart_saved_items
orders
order_items
escrow_transactions
refund_requests
payment_log

Delivery and drivers (10)

Courier roster, assignments and legs, OTPs at pickup and delivery, pickup-point shipments, earnings, payouts, tips, tracking events, GPS telemetry.

couriers
delivery_assignments
assignment_legs
collection_otps
pickup_shipments
driver_earnings
driver_payouts
tips
tracking_events
driver_pings

driver_pings GPS telemetry trail for delivery ETA learning.

Disputes, trust and reviews (5)

Reviews, disputes, evidence files, audit log, cached trust scores.

reviews
disputes
dispute_evidence
audit_log
user_risk_scores

user_risk_scores Cached trust and risk score per user (feed, fee and escrow perks).

Community and feed (5)

Communities, members, posts, post comments, post reactions.

communities
community_members
community_posts
post_comments
post_reactions

Offers, auctions, lay-bye and watch (8)

Counter-offers and swaps, auctions and bids, lay-bye plans and payments, wishlists, saved searches, referrals.

offers
auctions
bids
laybye_plans
laybye_payments
wishlists
saved_searches
referrals

Messaging and notifications (3)

Direct messages, notifications, public reports.

messages
notifications
reports

Experimentation (3)

Feature flag rollouts and event capture for A/B style toggles.

experiments
experiment_assignments
experiment_events

Total: 10 + 10 + 8 + 10 + 5 + 5 + 8 + 3 + 3 = 62 tables.

Migration story (44 files)

The repository keeps two complementary artefacts in db/:

db/schema.sql: the consolidated, idempotent re-runnable schema. A fresh clone applies this in one step.
db/migrations/*.sql: 44 ordered migration files showing the historical evolution. Each is numbered, e.g. 003-messages.sql through 044-seller-vacation.sql.

First-time setup (real commands)

README, db sectionbash

# From the project root
mysql -u root -p < db/schema.sql        # 62 tables
# Optional, for demo data:
for f in db/seeds/*.sql; do
  mysql -u root -p m2y < "$f"
done

Migration file roll-call

The numbered files in db/migrations/:

003-messages.sql
003-wishlists.sql
004-notifications.sql
005-offers.sql
006-courier-approval.sql
006-password-resets.sql
007-driver-incentives.sql
008-follows.sql
009-tracking-events.sql
010-reports.sql
012-saved-searches.sql
013-properties.sql
014-vehicles.sql
015-user-reports-blocks.sql
016-verification.sql
017-listing-expiry.sql
017-settings.sql
018-terms-acceptance.sql
019-maps.sql
020-profile-fields.sql
021-webhook-idempotency.sql
022-listings-browse-index.sql
023-seller-tiers.sql
024-kyc-tier.sql
025-cod-promoted.sql
026-community.sql
027-viral-community.sql
028-v11-indexes.sql
029-driver-radius-indexes.sql
030-books-subcategories.sql
031-property-deep-fields.sql
032-reservation-rules.sql
033-notifications-v11-types.sql
034-messages-extras.sql
035-cart-saved.sql
036-watchlist-saved-search-name.sql
037-disputes-extras.sql
038-refund-requests.sql
039-referrals.sql
040-vehicle-deep-fields.sql
041-experiments.sql
042-user-avatar-cover.sql
043-user-notification-prefs.sql
044-seller-vacation.sql

Seed story (10 files, 38 listings)

Demo data only. Seeds are never run in production. The seed bundle produces 38 listings spread across 27 categories, demo orders at each stage of the workflow, demo reviews, demo community posts, demo driver payouts and listing videos for the swipe feed.

010_v1_1_demo_flows.sql
01-demo-orders.sql
02-demo-reviews.sql
03-demo-engagement.sql
04-demo-driver-payments.sql
05-demo-user-polish.sql
06-community-demo.sql
07-demo-video.sql
08-catalogue-expansion.sql
09-listing-videos.sql

Security story

PDO prepared statements only. Every query in the application binds parameters with ? placeholders. EMULATE_PREPARES is OFF so MySQL parses the SQL once and the binds cannot be re-interpreted as SQL.
Bcrypt password hashing. password_hash() with the default algorithm and cost 12. Verified with password_verify(). No legacy MD5 or SHA1 anywhere.
CSRF tokens. csrf_token() in app/config/auth.php generates a per-session token. csrf_check() verifies with hash_equals on every POST.
Output escaping. Every user-supplied string is rendered through e() which calls htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8').
ENUM state machines. Orders, escrow, disputes, lay-bye, auctions and delivery assignments all carry ENUMs that the application gates with explicit allow-lists before any UPDATE.
InnoDB foreign keys. Money-bearing rows use ON DELETE RESTRICT. Owned children use ON DELETE CASCADE. FK checks are never disabled.
Webhook idempotency. The PayFast ITN handler checks payment_log for a previously-processed pf_payment_id and returns 200 OK without re-applying.
Session hardening. use_only_cookies on, use_strict_mode on, SameSite Lax, HttpOnly, Secure when HTTPS. Session regenerated on login.

phpMyAdmin screenshots

Structure views captured from phpMyAdmin, one per core domain. Each frame shows the column definitions, keys and indexes (schema only, no row data).

phpMyAdmin structure view of the users table — users (structure)

phpMyAdmin structure view of the listings table — listings (structure)

phpMyAdmin structure view of the categories table — categories (structure)

phpMyAdmin structure view of the listing_media table — listing_media (structure)

phpMyAdmin structure view of the orders table — orders (structure)

phpMyAdmin structure view of the escrow_transactions table — escrow_transactions (structure)

phpMyAdmin structure view of the couriers table — couriers (structure)

phpMyAdmin structure view of the communities table — communities (structure)

table list with all tables visible

m2y database: full table list