Dalelo — Classifieds Marketplace
An Arabic-first marketplace for real estate, vehicles, services and hotels, on the web and in mobile apps.
OverviewWhat this project is
Dalelo (دليلو) is an Arabic-first classifieds marketplace for Syria and the region, with tens of thousands of real-estate and vehicle listings plus services, places and hotels. It runs on the web and in native mobile apps, in Arabic, English and Turkish, with prices shown in 19 currencies.
ContextThe problem
The platform is built on Flynax, a commercial PHP classifieds engine, and has been extended over the years by several developers. It needed a lead developer to keep production stable while adding the features the mobile apps depend on, closing security gaps, controlling Google Maps costs and moving the site to a new design.
ContributionMy role & responsibilities
Lead developer in a small team (another developer and a designer). I work across the PHP backend, the database, the admin panel and the front end; changes go to a QA server first, then to production.
- Plan and ship platform features for web, admin and the mobile apps
- Security review and fixes across admin, API and payments
- Performance and cost controls for maps and geocoding
- Implement the new design across every page, in light and dark
ScopeKey features
- Mobile API: home data with featured listings, category tree, search and search-on-map, reels feeds, saved-search alerts, account and media endpoints
- Structured Areas: areas seeded from existing listings; in-area results first, then nearby by distance; typo-tolerant autocomplete
- Listing lifecycle: old-listing badges with self-service renewal, sold/rented filters, required photos and price
- Hotels directory with map-picked locations and photo galleries
- Composed share images (photos, price, location) for social link previews
- Admin: listing review queue, agency and governorate statistics, API blacklist
- Redesign: header, search card, listing and detail pages, directories, account pages, dark mode
SystemArchitecture
Web browsers · iOS & Android apps
↓ HTTPS
PHP (Flynax core + custom plugins, Smarty templates)
├─ API plugin: token auth · rate limits · blacklist → mobile apps
└─ Admin panel: review, statistics, settings
↓
MySQL · media storage · Google Maps Platform (cached, rate-limited)EngineeringChallenges & solutions
A security review found injectable queries, insecure direct object references and missing authorization in older admin and API code.
Fixed each finding at the source: escaped and parameterised queries, ownership checks on listing and media edits, CSRF origin checks in the admin panel, server-side payment amounts, and credential fields stripped from public account APIs.
Map and geocoding calls were a growing cost and a target for bots.
Per-bucket rate limits, a permanent blacklist for repeat offenders, cached Static Maps and Place Details, Places session tokens and throttled reverse geocoding.
Free-text locations made search by area unreliable.
A structured Areas model built in phases: data clean-up, an areas table seeded from existing listings, local resolution before calling Google, and an admin Areas page.
Redesigning a live right-to-left site without breaking it.
Eight staged releases on a QA server, each with light and dark regression passes, followed by English and Turkish passes.
OutcomeResults
- Security findings closed across admin, API and payment flows.
- New design live across the site in light and dark modes.
StackTech stack
Technology
- PHP
- Flynax
- Smarty
- MySQL
- JavaScript
- jQuery
- REST API
- Google Maps Platform
Tags
- marketplace
- RTL
- security
- mobile API
- redesign
NotesAdditional notes
Dalelo is built on the licensed Flynax platform; this case study covers custom work only. Visual design by the Dalelo design team.