- "require" is a PHP language construct and thus should not use parenthesis. - Every code path ends with a call to redirect(), no need to have this as a function (also fixes issue #3). - Your usage of rtrim() on the slug is weird at best. I'm guessing that you want to filter these characters out. This version only allows characters and numbers. - The redirect to Twitter uses the unescaped request URI. Tweets with an ID < 10m are rare enough to disregard (filters out false positives). - Your database-related constants are named oddly. You're connecting to *MySQL* through the *MySQLi* interface. It's still the MySQL username. - "SET NAMES" is deprecated in favor of the set_charset member function. - You escape the $slug variable twice (trice when there's a hit). It's not like that's going to make it any safer. - You should never use backticks around field and table names in a MySQL query. It's a bit eeeuw. - The hit-counter can perfectly be within the conditional code. No need to break functionality if we can't update. - Always shut down the database connections you open. This also cleans up used query memory. - Provide some fallbacks for proxies which filter out redirects;  (1) a <meta> refresh to the designated URL  (2) a JavaScript-based redirect, in try/catch for origin reasons.  (3) a text-link for those that still fail.
- "require" is a PHP language construct and thus should not use parenthesis.
- Every code path ends with a call to redirect(), no need to have this as a function (also fixes issue #3).
- Your usage of rtrim() on the slug is weird at best. I'm guessing that you want to filter these characters out. This version only allows characters and numbers.
- The redirect to Twitter uses the unescaped request URI. Tweets with an ID < 10m are rare enough to disregard (filters out false positives).
- Your database-related constants are named oddly. You're connecting to *MySQL* through the *MySQLi* interface. It's still the MySQL username.
- "SET NAMES" is deprecated in favor of the set_charset member function.
- You escape the $slug variable twice (trice when there's a hit). It's not like that's going to make it any safer.
- You should never use backticks around field and table names in a MySQL query. It's a bit eeeuw.
- The hit-counter can perfectly be within the conditional code. No need to break functionality if we can't update.
- Always shut down the database connections you open. This also cleans up used query memory.
- Provide some fallbacks for proxies which filter out redirects;
 (1) a <meta> refresh to the designated URL
 (2) a JavaScript-based redirect, in try/catch for origin reasons.
 (3) a text-link for those that still fail.
mathiasbynens/php-url-shortener,mkody/php-url-shortener