Exam Malpractice Incident Reporting System: a worked example in PHP and MySQL

The problem it solves

Examination malpractice incidents are often reported informally, lost in paper trails, or lack a clear record of decisions and follow-up. Staff need a simple, offline way to file reports and for officers to manage each case through to closure.

Who uses it

What it does

• Login and role-based access

  Secure login with hashed passwords, session management, CSRF protection and role-based visibility of screens.

• Incident report filing

  A single on-screen form to file a malpractice incident with all required fields and typed evidence notes.

• Case review, decision and closure workflow

  Officers review all reports, move status from Submitted to Under review, record decisions, close cases and add notes. Every change is saved with officer name and timestamp.

• Restricted views for reporters

  Reporters see only their own reports and can view detail and history but cannot change status.

• CSV export of filtered cases

  Export the currently filtered case list to CSV. Reporters export only their own filtered reports.

• User administration

  Create and manage user accounts and roles.

Screens

Screenshots of the running system, taken by our checks. The records are sample data and are labelled so on each page.

Database tables

• usersStores user accounts with role and hashed password.id, username, password_hash, full_name, role, created_at
• incident_reportsStores malpractice incident reports filed by reporters.id, reporter_id, student_name, matriculation_no, course_code, exam_date, venue, description, malpractice_type, evidence_note, status, filed_at
• case_historyStores each status change, decision and note with officer and timestamp.id, report_id, officer_id, status_from, status_to, decision, created_at

Built with

• PHP. The chosen stack and it runs in XAMPP on Windows and Linux.
• PDO with the MySQL driver. Prepared statements stop SQL injection and PDO is part of PHP.
• MariaDB or MySQL. Reliable relational storage for structured case records and constraints.
• Bootstrap. Consistent pages with no online dependency.
• Chart.js. Small chart library that works offline.
• theme.js. Keeps chart colours in one local file instead of hard-coded values.

How to run it: running a PHP project on XAMPP. Not sure which language to pick? Python or PHP.

How it was tested

67 of 67 tests passed, 67 of them automated. The system was also installed from scratch and every screen was opened as the right kind of user before it was accepted.

What it does not do

• Local XAMPP demonstration only; no online or multi-institution deployment.
• Evidence is typed text only; there are no file uploads.
• No real email or SMS; any student notification is simulated on screen and labelled.
• No public self-registration; an admin creates every account.
• Incident records cannot be deleted; closed cases keep their history for audit.
• Reporters can only see their own reports and cannot change a status.
• The demonstration was checked on PHP 8.2 with MariaDB on Linux and in a local browser; Windows, XAMPP and PHP 7.4 were not run here.