A Danish coworking space wanted members to book a table by the hour and pay for it — because at 20 kr. per hour per table, a booking that has not been paid for is not a booking. tableflow.grn.dk is that system, built from the client's brief and running live: an hour grid that shows what is actually free, a fifteen-minute payment hold that releases itself, and an admin screen for the people who run the place. Plain PHP and MariaDB — no framework, no dependencies, 853 lines in seven files.
- Client
- Danish coworking space — client brief, built as a working demo
- Sector
- Coworking and shared offices
- Period
- July 2026
At a glance
853
lines in 7 files — no framework, no dependencies
20
kr. per hour per table, priced live while you pick the hours
15-minute
payment hold that releases itself — no cron job
The challenge
The brief was short and unusually clear: PHP and a MySQL database; pick a date, a table and a from/to time; whole hours only and only inside opening hours; register name, e-mail and phone; 20 kr. per hour per table — and the table is not reserved until it has been paid for. Responsive, works well on a phone. Functional.
That one clause about payment is what turns a booking form into a small concurrency problem. The slot has to be held while the visitor pays, but not held forever if they wander off. Two people clicking the same hour in the same second must not both come away thinking they own it. And an expired, unpaid hold has to free itself — nobody at a coworking space is going to remember to sweep the table.
The solution
TableFlow is a deliberately small PHP 8.3 application on MariaDB, talking to the database through PDO with prepared statements. No framework, no Composer, no build step: 853 lines across seven files — four pages, a shared library, one stylesheet and a config file that lives outside the web root.
Booking. Choosing a date and a table redraws an hour grid where every hour is either free or struck through as taken. Clicking a free hour sets the start, clicking a later one extends the range across contiguous free hours only, and the price recalculates as you go — then gets recalculated again on the server, because the browser is a convenience and never the authority. Opening hours are a config table (Mon-Fri 08-20, Sat 09-16, Sunday closed), closed days say so instead of offering slots, and hours that have already passed today cannot be booked.
The hold, without a cron job. "This slot is blocked" is defined once, as a single SQL condition: the reservation is paid, or it was created within the last fifteen minutes. The grid, the booking check and the payment step all reuse that one definition, so an unpaid hold simply stops blocking when it ages out. Nothing has to run on a schedule, and there is no cleanup job to fail quietly.
Not double-booking. The insert runs inside a transaction that first selects the overlapping reservations FOR UPDATE. Two simultaneous bookings of the same hour serialise against each other, and the one that loses is told the time was just taken rather than being handed a phantom reservation. The payment step repeats the check, in case the hold expired while the visitor was paying and somebody else took the slot in the meantime.
Payment and the receipt. The payment page is reached through a random 32-character token, so a reservation is only visible to whoever made it. The button itself is an honest simulation, labelled in the UI as the swap-in point for MobilePay or a card gateway; paying flips the reservation to Betalt, stamps the time and turns the page into a receipt.
Admin. A password-protected screen lists upcoming reservations (or all of them), and lets whoever runs the space mark a booking paid — for cash, say — mark it unpaid again, or delete it. Unpaid holds past the window are flagged Udløbet: the time is free again, but it can still be settled manually if nobody else has taken it.
Everywhere else. Every POST carries a CSRF token, the booking form has a honeypot for bots, and date, time range, name, e-mail and phone are all validated server-side. The interface is Danish, mobile-first, and follows the visitor's light or dark system setting.
Delivery included the hosting: its own virtual host running under a dedicated tableflow system user, its own git repository, a database user scoped to just this application, credentials in a file the web root cannot serve, a Let's Encrypt certificate and an HTTP-to-HTTPS redirect, behind Cloudflare.
The results
The system has been live at tableflow.grn.dk since 23 July 2026 and was verified end to end before hand-over: a booking through to payment, a rejected double booking, the admin actions, and the closed-day guard.
Being 853 lines with no dependencies is the point rather than a boast. There is no framework to upgrade, no plugin tree to audit and no build that can break on a Tuesday — the code that runs is the code that was written, and a change to opening hours or the hourly rate is one line in a config file.
It is a demo, and it says so: the payment button simulates a transaction and the admin password is printed on its own login screen. Making it a production system for a specific coworking space is a scoped piece of work — a real payment gateway, proper admin accounts, the sample data cleared — not a rewrite.
“Man har først reserveret bordet, når man har betalt.” — the table is not reserved until it has been paid for.