GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (917)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/functions/common.php (21 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
if (!function_exists("pr")) {
4
5
    function pr($mixed)
6
    {
7
        echo "<pre>";
8
        print_r($mixed);
9
        echo "</pre>";
10
    }
11
12
}
13
14
function encode_url($input)
15
{
16
    $chars = array(
17
        '&#x102;' => 'a',
18
        '&#x103;' => 'a',
19
        '&#xC2;' => 'A',
20
        '&#xE2;' => 'a',
21
        '&#xCE;' => 'I',
22
        '&#xEE;' => 'i',
23
        '&#x218;' => 'S',
24
        '&#x219;' => 's',
25
        '&#x15E;' => 'S',
26
        '&#x15F;' => 's',
27
        '&#x21A;' => 'T',
28
        '&#x21B;' => 't',
29
        '&#354;' => 'T',
30
        '&#355;' => 't',
31
        '&#039;' => '',
32
    );
33
34
    foreach ($chars as $i => $v) {
35
        $chars[html_entity_decode($i, ENT_QUOTES, 'UTF-8')] = $v;
36
    }
37
38
    $input = strtr($input, $chars);
39
40
    preg_match_all("/[a-z0-9]+/i", $input, $chunks);
41
    $return_ = strtolower(implode("-", $chunks[0]));
42
43
    return $return_;
44
}
45
46
/**
47
 * @return string
48
 */
49
function current_url()
50
{
51 1
    return defined('CURRENT_URL') ? CURRENT_URL : null;
52
}
53
54
/**
55
 * Transforms a date's string representation into $format
56
 *
57
 * @param string $format
58
 * @param string|int $datetime
59
 * @return string/bool
0 ignored issues
show
The doc-type string/bool could not be parsed: Unknown type name "string/bool" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
60
 */
61
function _date($datetime, $format = false)
62
{
63
    $format = $format ? $format : Nip\locale()->getOption(['time', 'dateFormat']);
64
    $time = is_numeric($datetime) ? $datetime : strtotime($datetime);
65
66
    return $time ? date($format, $time) : false;
67
}
68
69
/**
70
 * Transforms a date's string representation into $format
71
 *
72
 * @param string $format
73
 * @param string|int $datetime
0 ignored issues
show
There is no parameter named $datetime. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
74
 * @return string/bool
0 ignored issues
show
The doc-type string/bool could not be parsed: Unknown type name "string/bool" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
75
 */
76
function _strtotime($date, $format = false)
77
{
78
    $format = $format ? $format : Nip\locale()->getOption(['time', 'dateStringFormat']);
79
    $dateArray = strptime($date, $format);
80
81
    return mktime($dateArray['tm_hour'], $dateArray['tm_min'], $dateArray['tm_sec'], 1 + $dateArray['tm_mon'],
82
        $dateArray['tm_mday'], 1900 + $dateArray['tm_year']);
83
}
84
85
/**
86
 * Transforms a date's string representation into $format
87
 *
88
 * @param string $format
89
 * @param string|int $datetime
90
 * @return string/bool
0 ignored issues
show
The doc-type string/bool could not be parsed: Unknown type name "string/bool" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
91
 */
92
function _strftime($datetime, $format = false)
93
{
94
    if ($datetime && strpos($datetime, '0000-00-00') === false) {
95
        $format = $format ? $format : Nip\locale()->getOption(['time', 'dateStringFormat']);
96
        if (is_numeric($datetime)) {
97
            $time = $datetime;
98
        } else {
99
            $time = strtotime($datetime);
100
        }
101
102
        if ($time !== false && $time !== -1) {
103
            return iconv("ISO-8859-2", "ASCII//TRANSLIT", strftime($format, $time));
104
        }
105
    }
106
107
    return false;
108
}
109
110
111
if (!function_exists("pluck")) {
112
113
    function pluck($array, $property)
114
    {
115
        return \Nip\HelperBroker::get('Arrays')->pluck($array, $property);
0 ignored issues
show
It seems like you code against a specific sub-type and not the parent class Nip\Helpers\AbstractHelper as the method pluck() does only exist in the following sub-classes of Nip\Helpers\AbstractHelper: Nip_Helper_Arrays. Maybe you want to instanceof check for one of these explicitly?

Let’s take a look at an example:

abstract class User
{
    /** @return string */
    abstract public function getPassword();
}

class MyUser extends User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}

In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.

Available Fixes

  1. Change the type-hint for the parameter:

    class AuthSystem
    {
        public function authenticate(MyUser $user) { /* ... */ }
    }
    
  2. Add an additional type-check:

    class AuthSystem
    {
        public function authenticate(User $user)
        {
            if ($user instanceof MyUser) {
                $this->logger->info(/** ... */);
            }
    
            // or alternatively
            if ( ! $user instanceof MyUser) {
                throw new \LogicException(
                    '$user must be an instance of MyUser, '
                   .'other instances are not supported.'
                );
            }
    
        }
    }
    
Note: PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case.
  1. Add the method to the parent class:

    abstract class User
    {
        /** @return string */
        abstract public function getPassword();
    
        /** @return string */
        abstract public function getDisplayName();
    }
    
Loading history...
116
    }
117
118
}
119
120
function max_upload()
121
{
122
    $post_max_size = ini_get('post_max_size');
123
    $upload_max_filesize = ini_get('upload_max_filesize');
124
125
    $unit = strtoupper(substr($post_max_size, -1));
126
    $multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));
127
    $post_max_size = ((int)$post_max_size) * $multiplier;
128
129
    $unit = strtoupper(substr($upload_max_filesize, -1));
130
    $multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));
131
    $upload_max_filesize = ((int)$upload_max_filesize) * $multiplier;
132
133
    return round((min($post_max_size, $upload_max_filesize) / 1048576), 2) . 'MB';
134
}
135
136
function valid_url($input)
137
{
138
    return preg_match("|^http(s)?://[a-z0-9-]+(.[a-z0-9-]+)*(:[0-9]+)?(/.*)?$|i", $input);
139
}
140
141
142
function valid_email($email)
143
{
144
    $isValid = true;
145
    $atIndex = strrpos($email, "@");
146
    if (is_bool($atIndex) && !$atIndex) {
147
        $isValid = false;
148
    } else {
149
        $domain = substr($email, $atIndex + 1);
150
        $local = substr($email, 0, $atIndex);
151
        $localLen = strlen($local);
152
        $domainLen = strlen($domain);
153
        if ($localLen < 1 || $localLen > 64) {
154
            // local part length exceeded
155
            $isValid = false;
156
        } else {
157
            if ($domainLen < 1 || $domainLen > 255) {
158
                // domain part length exceeded
159
                $isValid = false;
160
            } else {
161
                if ($local[0] == '.' || $local[$localLen - 1] == '.') {
162
                    // local part starts or ends with '.'
163
                    $isValid = false;
164
                } else {
165
                    if (preg_match('/\.\./', $local)) {
166
                        // local part has two consecutive dots
167
                        $isValid = false;
168
                    } else {
169
                        if (!preg_match('/^[A-Za-z0-9\-\.]+$/', $domain)) {
170
                            // character not valid in domain part
171
                            $isValid = false;
172
                        } else {
173
                            if (preg_match('/\.\./', $domain)) {
174
                                // domain part has two consecutive dots
175
                                $isValid = false;
176
                            } else {
177
                                if (!preg_match('/^(\.|[A-Za-z0-9!#%&`_=\/$\'*+?^{}|~.-])+$/',
178
                                    str_replace("\\", "", $local))
179
                                ) {
180
                                    // character not valid in local part unless
181
                                    // local part is quoted
182
                                    if (!preg_match('/^"(\"|[^"])+"$/', str_replace("\\", "", $local))) {
183
                                        $isValid = false;
184
                                    }
185
                                }
186
                            }
187
                        }
188
                    }
189
                }
190
            }
191
        }
192
        if ($isValid && !(checkdnsrr($domain, "MX") || checkdnsrr($domain, "A"))) {
193
            // domain not found in DNS
194
            $isValid = false;
195
        }
196
    }
197
198
    return $isValid;
199
}
200
201
function valid_cc_number($cc_number)
202
{
203
    /* Validate; return value is card type if valid. */
204
    $card_type = "";
205
    $card_regexes = array(
206
        "/^4\d{12}(\d\d\d){0,1}$/" => "visa",
207
        "/^5[12345]\d{14}$/" => "mastercard",
208
        "/^3[47]\d{13}$/" => "amex",
209
        "/^6011\d{12}$/" => "discover",
210
        "/^30[012345]\d{11}$/" => "diners",
211
        "/^3[68]\d{12}$/" => "diners",
212
    );
213
214
    foreach ($card_regexes as $regex => $type) {
215
        if (preg_match($regex, $cc_number)) {
216
            $card_type = $type;
217
            break;
218
        }
219
    }
220
221
    if (!$card_type) {
222
        return false;
223
    }
224
225
    /*  mod 10 checksum algorithm  */
226
    $revcode = strrev($cc_number);
227
    $checksum = 0;
228
229
    for ($i = 0; $i < strlen($revcode); $i++) {
230
        $current_num = intval($revcode[$i]);
231
        if ($i & 1) {  /* Odd  position */
232
            $current_num *= 2;
233
        }
234
        /* Split digits and add. */
235
        $checksum += $current_num % 10;
236
        if
237
        ($current_num > 9
238
        ) {
239
            $checksum += 1;
240
        }
241
    }
242
243
    if ($checksum % 10 == 0) {
244
        return $card_type;
245
    } else {
246
        return false;
247
    }
248
}
249
250
function valid_cnp($cnp)
251
{
252
    $const = '279146358279';
253
    $cnp = trim($cnp);
254
255
    preg_match("|^([1256])(\d{2})(\d{2})(\d{2})(\d{6})$|ims", $cnp, $results);
256
    if (count($results) < 1) {
257
        return false;
258
    }
259
260
    $mf = $results[1] + 0;
261
    if ($mf == 5 || $mf == 6) {
262
        $year_add = 2000;
263
    } else {
264
        $year_add = 1900;
265
    }
266
    $year = $year_add + $results[2];
267
    $month = $results[3] + 0;
268
    $day = $results[4] + 0;
269
270
    if (!checkdate($month, $day, $year)) {
271
        return false;
272
    }
273
274
    $suma = 0;
275
    for ($i = 0; $i < 12; $i++) {
276
        $suma += $const[$i] * $cnp[$i];
277
    }
278
279
    $rest = $suma % 11;
280
281
    $c13 = $cnp[12] + 0;
282
283
    if (!(($rest < 10 && $rest == $c13) || ($rest == 10 && $c13 == 1))) {
284
        return false;
285
    }
286
287
    return true;
288
}
289
290
if (!function_exists("money_format")) {
291
    function money_format($format, $number)
292
    {
293
        $regex = '/%((?:[\^!\-]|\+|\(|\=.)*)([0-9]+)?' .
294
            '(?:#([0-9]+))?(?:\.([0-9]+))?([in%])/';
295
        if (setlocale(LC_MONETARY, 0) == 'C') {
296
            setlocale(LC_MONETARY, '');
297
        }
298
        $locale = localeconv();
299
        preg_match_all($regex, $format, $matches, PREG_SET_ORDER);
300
        foreach ($matches as $fmatch) {
0 ignored issues
show
The expression $matches of type null|array<integer,array<integer,string>> is not guaranteed to be traversable. How about adding an additional type check?

There are different options of fixing this problem.

  1. If you want to be on the safe side, you can add an additional type-check:

    $collection = json_decode($data, true);
    if ( ! is_array($collection)) {
        throw new \RuntimeException('$collection must be an array.');
    }
    
    foreach ($collection as $item) { /** ... */ }
    
  2. If you are sure that the expression is traversable, you might want to add a doc comment cast to improve IDE auto-completion and static analysis:

    /** @var array $collection */
    $collection = json_decode($data, true);
    
    foreach ($collection as $item) { /** .. */ }
    
  3. Mark the issue as a false-positive: Just hover the remove button, in the top-right corner of this issue for more options.

Loading history...
301
            $value = floatval($number);
302
            $flags = array(
303
                'fillchar' => preg_match('/\=(.)/', $fmatch[1], $match) ?
304
                    $match[1] : ' ',
305
                'nogroup' => preg_match('/\^/', $fmatch[1]) > 0,
306
                'usesignal' => preg_match('/\+|\(/', $fmatch[1], $match) ?
307
                    $match[0] : '+',
308
                'nosimbol' => preg_match('/\!/', $fmatch[1]) > 0,
309
                'isleft' => preg_match('/\-/', $fmatch[1]) > 0,
310
            );
311
            $width = trim($fmatch[2]) ? (int)$fmatch[2] : 0;
312
            $left = trim($fmatch[3]) ? (int)$fmatch[3] : 0;
313
            $right = trim($fmatch[4]) ? (int)$fmatch[4] : $locale['int_frac_digits'];
314
            $conversion = $fmatch[5];
315
316
            $positive = true;
317
            if ($value < 0) {
318
                $positive = false;
319
                $value *= -1;
320
            }
321
            $letter = $positive ? 'p' : 'n';
322
323
            $prefix = $suffix = $cprefix = $csuffix = $signal = '';
0 ignored issues
show
$signal is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
324
325
            $signal = $positive ? $locale['positive_sign'] : $locale['negative_sign'];
326
            switch (true) {
327 View Code Duplication
                case $locale["{$letter}_sign_posn"] == 1 && $flags['usesignal'] == '+':
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
328
                    $prefix = $signal;
329
                    break;
330 View Code Duplication
                case $locale["{$letter}_sign_posn"] == 2 && $flags['usesignal'] == '+':
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
331
                    $suffix = $signal;
332
                    break;
333 View Code Duplication
                case $locale["{$letter}_sign_posn"] == 3 && $flags['usesignal'] == '+':
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
334
                    $cprefix = $signal;
335
                    break;
336 View Code Duplication
                case $locale["{$letter}_sign_posn"] == 4 && $flags['usesignal'] == '+':
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
337
                    $csuffix = $signal;
338
                    break;
339
                case $flags['usesignal'] == '(':
340
                case $locale["{$letter}_sign_posn"] == 0:
341
                    $prefix = '(';
342
                    $suffix = ')';
343
                    break;
344
            }
345
            if (!$flags['nosimbol']) {
346
                $currency = $cprefix .
347
                    ($conversion == 'i' ? $locale['int_curr_symbol'] : $locale['currency_symbol']) .
348
                    $csuffix;
349
            } else {
350
                $currency = '';
351
            }
352
            $space = $locale["{$letter}_sep_by_space"] ? ' ' : '';
353
354
            $value = number_format($value, $right, $locale['mon_decimal_point'],
355
                $flags['nogroup'] ? '' : $locale['mon_thousands_sep']);
356
            $value = @explode($locale['mon_decimal_point'], $value);
357
358
            $n = strlen($prefix) + strlen($currency) + strlen($value[0]);
359
            if ($left > 0 && $left > $n) {
360
                $value[0] = str_repeat($flags['fillchar'], $left - $n) . $value[0];
361
            }
362
            $value = implode($locale['mon_decimal_point'], $value);
363
            if ($locale["{$letter}_cs_precedes"]) {
364
                $value = $prefix . $currency . $space . $value . $suffix;
365
            } else {
366
                $value = $prefix . $value . $space . $currency . $suffix;
367
            }
368
            if ($width > 0) {
369
                $value = str_pad($value, $width, $flags['fillchar'], $flags['isleft'] ?
370
                    STR_PAD_RIGHT : STR_PAD_LEFT);
371
            }
372
373
            $format = str_replace($fmatch[0], $value, $format);
374
        }
375
376
        return $format;
377
    }
378
}
379
380
if (!function_exists("json_decode")) {
381
382
    function json_decode(
383
        $json,
384
        $assoc = false, /* emu_args */
385
        $n = 0,
386
        $state = 0,
387
        $waitfor = 0
388
    )
389
    {
390
391
        #-- result var
392
        $val = null;
393
        static $lang_eq = array("true" => true, "false" => false, "null" => null);
394
        static $str_eq = array(
395
            "n" => "\012",
396
            "r" => "\015",
397
            "\\" => "\\",
398
            '"' => '"',
399
            "f" => "\f",
400
            "b" => "\b",
401
            "t" => "\t",
402
            "/" => "/",
403
        );
404
405
        #-- flat char-wise parsing
406
        for (/* n */; $n < strlen($json); /* n */) {
407
            $c = $json[$n];
408
409
            #-= in-string
410
            if ($state === '"') {
411
412
                if ($c == '\\') {
413
                    $c = $json[++$n];
414
                    // simple C escapes
415
                    if (isset($str_eq[$c])) {
416
                        $val .= $str_eq[$c];
417
                    } // here we transform \uXXXX Unicode (always 4 nibbles) references to UTF-8
418
                    elseif ($c == "u") {
419
                        // read just 16bit (therefore value can't be negative)
420
                        $hex = hexdec(substr($json, $n + 1, 4));
421
                        $n += 4;
422
                        // Unicode ranges
423
                        if ($hex < 0x80) { // plain ASCII character
424
                            $val .= chr($hex);
425
                        } elseif ($hex < 0x800) {   // 110xxxxx 10xxxxxx
426
                            $val .= chr(0xC0 + $hex >> 6) . chr(0x80 + $hex & 63);
427
                        } elseif ($hex <= 0xFFFF) { // 1110xxxx 10xxxxxx 10xxxxxx
428
                            $val .= chr(0xE0 + $hex >> 12) . chr(0x80 + ($hex >> 6) & 63) . chr(0x80 + $hex & 63);
429
                        }
430
                        // other ranges, like 0x1FFFFF=0xF0, 0x3FFFFFF=0xF8 and 0x7FFFFFFF=0xFC do not apply
0 ignored issues
show
Unused Code Comprehensibility introduced by
36% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
431
                    }
432
433
                    // no escape, just a redundant backslash
434
                    //@COMPAT: we could throw an exception here
435
                    else {
436
                        $val .= "\\" . $c;
437
                    }
438
                } // end of string
439
                elseif ($c == '"') {
440
                    $state = 0;
441
                } // yeeha! a single character found!!!!1!
0 ignored issues
show
Unused Code Comprehensibility introduced by
42% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
442
                else/* if (ord($c) >= 32) */ { //@COMPAT: specialchars check - but native json doesn't do it?
0 ignored issues
show
Unused Code Comprehensibility introduced by
50% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
443
                    $val .= $c;
444
                }
445
            } #-> end of sub-call (array/object)
446
            elseif ($waitfor && (strpos($waitfor, $c) !== false)) {
447
                return array($val, $n);  // return current value and state
448
            } #-= in-array
449
            elseif ($state === ']') {
450
                list($v, $n) = json_decode($json, 0, $n, 0, ",]");
0 ignored issues
show
0 is of type integer, but the function expects a boolean.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
451
                $val[] = $v;
452
                if ($json[$n] == "]") {
453
                    return array($val, $n);
454
                }
455
            } #-= in-object
456
            elseif ($state === '}') {
457
                list($i, $n) = json_decode($json, 0, $n, 0, ":");   // this allowed non-string indicies
0 ignored issues
show
0 is of type integer, but the function expects a boolean.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
458
                list($v, $n) = json_decode($json, 0, $n + 1, 0, ",}");
0 ignored issues
show
0 is of type integer, but the function expects a boolean.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
459
                $val[$i] = $v;
460
                if ($json[$n] == "}") {
461
                    return array($val, $n);
462
                }
463
            } #-- looking for next item (0)
464
            else {
465
466
                #-> whitespace
467
                if (preg_match("/\s/", $c)) {
0 ignored issues
show
This if statement is empty and can be removed.

This check looks for the bodies of if statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.

These if bodies can be removed. If you have an empty if but statements in the else branch, consider inverting the condition.

if (rand(1, 6) > 3) {
//print "Check failed";
} else {
    print "Check succeeded";
}

could be turned into

if (rand(1, 6) <= 3) {
    print "Check succeeded";
}

This is much more concise to read.

Loading history...
468
                    // skip
469
                } #-> string begin
470
                elseif ($c == '"') {
471
                    $state = '"';
472
                } #-> object
473
                elseif ($c == "{") {
474
                    list($val, $n) = json_decode($json, $assoc, $n + 1, '}', "}");
475
                    if ($val && $n && !$assoc) {
476
                        $obj = new stdClass();
477
                        foreach ($val as $i => $v) {
478
                            $obj->{$i} = $v;
479
                        }
480
                        $val = $obj;
481
                        unset($obj);
482
                    }
483
                } #-> array
484
                elseif ($c == "[") {
485
                    list($val, $n) = json_decode($json, $assoc, $n + 1, ']', "]");
486
                } #-> comment
487
                elseif (($c == "/") && ($json[$n + 1] == "*")) {
488
                    // just find end, skip over
489
                    ($n = strpos($json, "*/", $n + 1)) or ($n = strlen($json));
0 ignored issues
show
Comprehensibility Best Practice introduced by
Using logical operators such as or instead of || is generally not recommended.

PHP has two types of connecting operators (logical operators, and boolean operators):

  Logical Operators Boolean Operator
AND - meaning and &&
OR - meaning or ||

The difference between these is the order in which they are executed. In most cases, you would want to use a boolean operator like &&, or ||.

Let’s take a look at a few examples:

// Logical operators have lower precedence:
$f = false or true;

// is executed like this:
($f = false) or true;


// Boolean operators have higher precedence:
$f = false || true;

// is executed like this:
$f = (false || true);

Logical Operators are used for Control-Flow

One case where you explicitly want to use logical operators is for control-flow such as this:

$x === 5
    or die('$x must be 5.');

// Instead of
if ($x !== 5) {
    die('$x must be 5.');
}

Since die introduces problems of its own, f.e. it makes our code hardly testable, and prevents any kind of more sophisticated error handling; you probably do not want to use this in real-world code. Unfortunately, logical operators cannot be combined with throw at this point:

// The following is currently a parse error.
$x === 5
    or throw new RuntimeException('$x must be 5.');

These limitations lead to logical operators rarely being of use in current PHP code.

Loading history...
490
                } #-> numbers
491
                elseif (preg_match("#^(-?\d+(?:\.\d+)?)(?:[eE]([-+]?\d+))?#", substr($json, $n), $uu)) {
492
                    $val = $uu[1];
493
                    $n += strlen($uu[0]) - 1;
494
                    if (strpos($val, ".")) {  // float
495
                        $val = (float)$val;
496
                    } elseif ($val[0] == "0") {  // oct
497
                        $val = octdec($val);
498
                    } else {
499
                        $val = (int)$val;
500
                    }
501
                    // exponent?
502
                    if (isset($uu[2])) {
503
                        $val *= pow(10, (int)$uu[2]);
504
                    }
505
                } #-> boolean or null
0 ignored issues
show
Unused Code Comprehensibility introduced by
43% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
506
                elseif (preg_match("#^(true|false|null)\b#", substr($json, $n), $uu)) {
507
                    $val = $lang_eq[$uu[1]];
508
                    $n += strlen($uu[1]) - 1;
509
                } #-- parsing error
510
                else {
511
                    // PHPs native json_decode() breaks here usually and QUIETLY
512
                    trigger_error("json_decode: error parsing '$c' at position $n", E_USER_WARNING);
513
514
                    return $waitfor ? array(null, 1 << 30) : null;
515
                }
516
            }//state
517
            #-- next char
518
            if ($n === null) {
519
                return null;
520
            }
521
            $n++;
522
        }//for
523
        #-- final result
524
        return ($val);
525
    }
526
527
}
528
529
function _htmlDistance($distance)
530
{
531
    $integer = intval($distance);
0 ignored issues
show
$integer is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
532
    $decimalPosition = strrpos($distance, '.');
533
    $decimal = $decimalPosition === false ? false : substr($distance, $decimalPosition);
534
535
    return intval($distance) . ($decimal ? '<small>' . $decimal . '</small>' : '');
536
}
537