This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Brouzie\Sphinxy; |
||
4 | |||
5 | class QueryBuilder |
||
6 | { |
||
7 | const TYPE_INSERT = 1; |
||
8 | const TYPE_SELECT = 2; |
||
9 | const TYPE_UPDATE = 3; |
||
10 | const TYPE_DELETE = 4; |
||
11 | const TYPE_REPLACE = 5; |
||
12 | |||
13 | /** |
||
14 | * @var Connection |
||
15 | */ |
||
16 | private $conn; |
||
17 | |||
18 | private $type; |
||
19 | |||
20 | private $sqlParts = array( |
||
21 | 'select' => array(), |
||
22 | 'from' => array(), |
||
23 | 'where' => array(), |
||
24 | 'groupBy' => array(), |
||
25 | 'groupByLimit' => null, |
||
26 | 'withinGroupOrderBy' => array(), |
||
27 | 'orderBy' => array(), |
||
28 | 'facet' => array(), |
||
29 | 'resultSetNames' => array(0), |
||
30 | 'set' => array(), |
||
31 | 'values' => array(), |
||
32 | 'options' => array(), |
||
33 | 'firstResult' => 0, |
||
34 | 'maxResults' => null, |
||
35 | ); |
||
36 | |||
37 | private static $multipleParts = array( |
||
38 | 'select' => true, |
||
39 | 'from' => true, |
||
40 | 'where' => true, |
||
41 | 'groupBy' => true, |
||
42 | 'groupByLimit' => false, |
||
43 | 'withinGroupOrderBy' => true, |
||
44 | 'orderBy' => true, |
||
45 | 'facet' => true, |
||
46 | 'resultSetNames' => true, |
||
47 | 'set' => true, |
||
48 | 'values' => true, |
||
49 | 'options' => true, |
||
50 | 'firstResult' => false, |
||
51 | 'maxResults' => false, |
||
52 | ); |
||
53 | |||
54 | private $isDirty = true; |
||
55 | |||
56 | private $sql; |
||
57 | |||
58 | private $parameters = array(); |
||
59 | |||
60 | private $parametersCounter = 0; |
||
61 | |||
62 | 81 | public function __construct(Connection $conn) |
|
63 | { |
||
64 | 81 | $this->conn = $conn; |
|
65 | 81 | } |
|
66 | |||
67 | public function getEscaper() |
||
68 | { |
||
69 | return $this->conn->getEscaper(); |
||
70 | } |
||
71 | |||
72 | 60 | public function select($select = null) |
|
73 | { |
||
74 | 60 | $this->type = self::TYPE_SELECT; |
|
75 | 60 | if (null === $select) { |
|
76 | return $this; |
||
77 | } |
||
78 | |||
79 | 60 | return $this->add('select', (array) $select); |
|
80 | } |
||
81 | |||
82 | 9 | public function addSelect($select) |
|
83 | { |
||
84 | 9 | $this->type = self::TYPE_SELECT; |
|
85 | |||
86 | 9 | return $this->add('select', (array) $select, true); |
|
87 | } |
||
88 | |||
89 | 6 | public function update($index) |
|
90 | { |
||
91 | 6 | $this->type = self::TYPE_UPDATE; |
|
92 | |||
93 | 6 | return $this->add('from', array('table' => $index)); |
|
94 | } |
||
95 | |||
96 | 6 | public function insert($index) |
|
97 | { |
||
98 | 6 | $this->type = self::TYPE_INSERT; |
|
99 | |||
100 | 6 | return $this->add('from', array('table' => $index)); |
|
101 | } |
||
102 | |||
103 | 3 | public function replace($index) |
|
104 | { |
||
105 | 3 | $this->type = self::TYPE_REPLACE; |
|
106 | |||
107 | 3 | return $this->add('from', array('table' => $index)); |
|
108 | } |
||
109 | |||
110 | 3 | public function delete($index) |
|
111 | { |
||
112 | 3 | $this->type = self::TYPE_DELETE; |
|
113 | |||
114 | 3 | return $this->add('from', array('table' => $index)); |
|
115 | } |
||
116 | |||
117 | 6 | public function set($key, $value) |
|
118 | { |
||
119 | 6 | return $this->add('set', compact('key', 'value'), true); |
|
120 | } |
||
121 | |||
122 | 9 | public function values(array $values) |
|
123 | { |
||
124 | 9 | return $this->add('values', $values); |
|
125 | } |
||
126 | |||
127 | 3 | public function addValues(array $values) |
|
128 | { |
||
129 | 3 | return $this->add('values', $values, true); |
|
130 | } |
||
131 | |||
132 | 60 | public function from($index) |
|
133 | { |
||
134 | 60 | return $this->add('from', array('table' => $index)); |
|
135 | } |
||
136 | |||
137 | 3 | public function addFrom($index) |
|
138 | { |
||
139 | 3 | return $this->add('from', array('table' => $index), true); |
|
140 | } |
||
141 | |||
142 | 39 | public function where($where) |
|
143 | { |
||
144 | 39 | return $this->add('where', $where); |
|
145 | } |
||
146 | |||
147 | 9 | public function andWhere($where) |
|
148 | { |
||
149 | 9 | return $this->add('where', $where, true); |
|
150 | } |
||
151 | |||
152 | 15 | public function groupBy($groupBy, $limit = null) |
|
153 | { |
||
154 | 10 | return $this |
|
155 | 15 | ->add('groupBy', $groupBy) |
|
156 | 15 | ->add('groupByLimit', $limit); |
|
157 | } |
||
158 | |||
159 | 3 | public function addGroupBy($groupBy) |
|
160 | { |
||
161 | 3 | return $this->add('groupBy', $groupBy, true); |
|
162 | } |
||
163 | |||
164 | 6 | public function withinGroupOrderBy($order, $direction = null) |
|
165 | { |
||
166 | 6 | return $this->add('withinGroupOrderBy', compact('order', 'direction')); |
|
167 | } |
||
168 | |||
169 | 3 | public function addWithinGroupOrderBy($order, $direction = null) |
|
170 | { |
||
171 | 3 | return $this->add('withinGroupOrderBy', compact('order', 'direction'), true); |
|
172 | } |
||
173 | |||
174 | /** |
||
175 | * @param string|array $facet 'column1', or array('column1', 'column1') or array('column1' => 'column_alias', 'column2') |
||
176 | * @param string $by |
||
177 | * @param string $order |
||
178 | * @param string $direction |
||
179 | * @param int $limit |
||
180 | * @param int $skip |
||
181 | * |
||
182 | * @return $this |
||
183 | */ |
||
184 | 3 | public function facet($facet, $by = null, $order = null, $direction = null, $limit = null, $skip = 0) |
|
185 | { |
||
186 | 3 | $facet = (array) $facet; |
|
187 | |||
188 | 3 | return $this->add('facet', compact('facet', 'by', 'order', 'direction', 'limit', 'skip'), true); |
|
189 | } |
||
190 | |||
191 | public function nameResultSet($name) |
||
192 | { |
||
193 | return $this->add('resultSetNames', $name, true); |
||
194 | } |
||
195 | |||
196 | 9 | public function orderBy($order, $direction = null) |
|
197 | { |
||
198 | 9 | return $this->add('orderBy', compact('order', 'direction')); |
|
199 | } |
||
200 | |||
201 | 6 | public function addOrderBy($order, $direction = null) |
|
202 | { |
||
203 | 6 | return $this->add('orderBy', compact('order', 'direction'), true); |
|
204 | } |
||
205 | |||
206 | 6 | public function setOption($name, $value) |
|
207 | { |
||
208 | 6 | return $this->add('options', compact('name', 'value'), true); |
|
209 | } |
||
210 | |||
211 | 6 | public function setMaxResults($limit) |
|
212 | { |
||
213 | 6 | return $this->add('maxResults', $limit); |
|
214 | } |
||
215 | |||
216 | 3 | public function setFirstResult($skip) |
|
217 | { |
||
218 | 3 | return $this->add('firstResult', $skip); |
|
219 | } |
||
220 | |||
221 | public function merge(self $qb) |
||
0 ignored issues
–
show
|
|||
222 | { |
||
223 | //TODO: делать или не делать? |
||
224 | // ... |
||
225 | } |
||
226 | |||
227 | 9 | public function setParameter($parameter, $value) |
|
228 | { |
||
229 | 9 | $this->parameters[$parameter] = $value; |
|
230 | |||
231 | 9 | return $this; |
|
232 | } |
||
233 | |||
234 | /** |
||
235 | * Creates a new named parameter and bind the value $value to it. |
||
236 | * |
||
237 | * @param string $value |
||
238 | * @param string $prefix the name to bind with |
||
239 | * |
||
240 | * @return string the placeholder name used |
||
241 | */ |
||
242 | 6 | public function createParameter($value, $prefix = 'gen_') |
|
243 | { |
||
244 | 6 | $prefix = preg_replace('/[^a-z0-9_]/ui', '_', $prefix); |
|
245 | 6 | $prefix .= ++$this->parametersCounter; |
|
246 | 6 | $this->setParameter($prefix, $value); |
|
247 | |||
248 | 6 | return ':'.$prefix; |
|
249 | } |
||
250 | |||
251 | 9 | public function getParameters() |
|
252 | { |
||
253 | 9 | return $this->parameters; |
|
254 | } |
||
255 | |||
256 | public function execute() |
||
257 | { |
||
258 | return $this->conn->executeUpdate($this->getSql(), $this->parameters); |
||
259 | } |
||
260 | |||
261 | public function getResult() |
||
262 | { |
||
263 | return $this->conn->executeQuery($this->getSql(), $this->parameters); |
||
264 | } |
||
265 | |||
266 | public function getMultiResult() |
||
267 | { |
||
268 | return $this->conn->executeMultiQuery($this->getSql(), $this->parameters, array(), $this->sqlParts['resultSetNames']); |
||
269 | } |
||
270 | |||
271 | 78 | public function getSql() |
|
272 | { |
||
273 | 78 | if (!$this->isDirty) { |
|
274 | return $this->sql; |
||
275 | } |
||
276 | |||
277 | 78 | switch ($this->type) { |
|
278 | 78 | case self::TYPE_SELECT: |
|
279 | 60 | $this->sql = $this->buildSqlForSelect(); |
|
280 | 60 | break; |
|
281 | |||
282 | 18 | case self::TYPE_INSERT: |
|
283 | 16 | case self::TYPE_REPLACE: |
|
284 | 9 | $this->sql = $this->buildSqlForInsert(); |
|
285 | 9 | break; |
|
286 | |||
287 | 9 | case self::TYPE_UPDATE: |
|
288 | 6 | $this->sql = $this->buildSqlForUpdate(); |
|
289 | 6 | break; |
|
290 | |||
291 | 3 | case self::TYPE_DELETE: |
|
292 | 3 | $this->sql = $this->buildSqlForDelete(); |
|
293 | 3 | break; |
|
294 | 52 | } |
|
295 | |||
296 | 78 | $this->isDirty = false; |
|
297 | |||
298 | 78 | return $this->sql; |
|
299 | } |
||
300 | |||
301 | /** |
||
302 | * Either appends to or replaces a single, generic query part. |
||
303 | * |
||
304 | * @param string $sqlPartName |
||
305 | * @param string|array $sqlPart |
||
306 | * @param bool $append |
||
307 | * |
||
308 | * @return $this this QueryBuilder instance |
||
309 | */ |
||
310 | 78 | protected function add($sqlPartName, $sqlPart, $append = false) |
|
311 | { |
||
312 | 78 | $this->isDirty = true; |
|
313 | |||
314 | 78 | if (self::$multipleParts[$sqlPartName]) { |
|
315 | 78 | if ($append) { |
|
316 | 45 | $this->sqlParts[$sqlPartName][] = $sqlPart; |
|
317 | 30 | } else { |
|
318 | 78 | $this->sqlParts[$sqlPartName] = array($sqlPart); |
|
319 | } |
||
320 | 52 | } else { |
|
321 | 21 | $this->sqlParts[$sqlPartName] = $sqlPart; |
|
322 | } |
||
323 | |||
324 | 78 | return $this; |
|
325 | } |
||
326 | |||
327 | 60 | protected function buildSqlForSelect() |
|
328 | { |
||
329 | 60 | $select = call_user_func_array('array_merge', $this->sqlParts['select']); |
|
330 | 60 | $query = 'SELECT '.implode(', ', $select).' FROM '; |
|
331 | |||
332 | 60 | $fromParts = array(); |
|
333 | 60 | foreach ($this->sqlParts['from'] as $from) { |
|
334 | 60 | $table = $from['table']; |
|
335 | 60 | if ($table instanceof static) { |
|
336 | 3 | $fromParts[] = '('.$table->getSql().')'; |
|
337 | 3 | foreach ($table->getParameters() as $parameter => $value) { |
|
338 | 3 | $this->setParameter($parameter, $value); |
|
339 | 2 | } |
|
340 | 2 | } else { |
|
341 | 60 | $fromParts[] = $table; |
|
342 | } |
||
343 | 40 | } |
|
344 | |||
345 | 60 | $query .= implode(', ', $fromParts) |
|
346 | 60 | .$this->buildWherePart() |
|
347 | 60 | .$this->buildGroupByPart() |
|
348 | 60 | .$this->buildOrderByPart(); |
|
349 | |||
350 | //TODO: inject limit, skip as parameters for better caching? Or just move caching to upper layer |
||
351 | 60 | if ($this->sqlParts['maxResults']) { |
|
352 | 6 | $query .= ' LIMIT '.(int) $this->sqlParts['firstResult'].', '.(int) $this->sqlParts['maxResults']; |
|
353 | 4 | } |
|
354 | |||
355 | 60 | $query .= $this->buildOptionsPart() |
|
356 | 60 | .$this->buildFacetPart(); |
|
357 | |||
358 | 60 | return $query; |
|
359 | } |
||
360 | |||
361 | 9 | protected function buildSqlForInsert() |
|
362 | { |
||
363 | 9 | $columns = array(); |
|
364 | 9 | $valuesParts = array(); |
|
365 | 9 | foreach ($this->sqlParts['values'] as $value) { |
|
366 | //TODO: check columns |
||
367 | 9 | $columns = array_keys($value); |
|
368 | 9 | $valuesParts[] = '('.implode(', ', $value).')'; |
|
369 | 6 | } |
|
370 | |||
371 | 9 | $index = current($this->sqlParts['from'])['table']; |
|
372 | 9 | $query = ($this->type === self::TYPE_REPLACE ? 'REPLACE' : 'INSERT') |
|
373 | 9 | .' INTO '.$index |
|
374 | 9 | .' ('.implode(', ', $columns).') VALUES '.implode(', ', $valuesParts); |
|
375 | |||
376 | 9 | return $query; |
|
377 | } |
||
378 | |||
379 | 6 | protected function buildSqlForUpdate() |
|
380 | { |
||
381 | 6 | $index = current($this->sqlParts['from'])['table']; |
|
382 | 6 | $setParts = array(); |
|
383 | 6 | foreach ($this->sqlParts['set'] as $setPart) { |
|
384 | 6 | $setParts[] = $setPart['key'].' = '.$setPart['value']; |
|
385 | 4 | } |
|
386 | |||
387 | 6 | $query = 'UPDATE '.$index.' SET '.implode(', ', $setParts).$this->buildWherePart(); |
|
388 | |||
389 | 6 | return $query; |
|
390 | } |
||
391 | |||
392 | 3 | protected function buildSqlForDelete() |
|
393 | { |
||
394 | 3 | $index = current($this->sqlParts['from'])['table']; |
|
395 | 3 | $query = 'DELETE FROM '.$index.$this->buildWherePart(); |
|
396 | |||
397 | 3 | return $query; |
|
398 | } |
||
399 | |||
400 | 69 | protected function buildWherePart() |
|
401 | { |
||
402 | 69 | if (!$this->sqlParts['where']) { |
|
403 | 33 | return ''; |
|
404 | } |
||
405 | |||
406 | 39 | return ' WHERE '.implode(' AND ', $this->sqlParts['where']); |
|
407 | } |
||
408 | |||
409 | 60 | protected function buildGroupByPart() |
|
410 | { |
||
411 | 60 | if (!$this->sqlParts['groupBy']) { |
|
412 | 45 | return ''; |
|
413 | } |
||
414 | |||
415 | 15 | $sql = ' GROUP'.($this->sqlParts['groupByLimit'] ? ' '.$this->sqlParts['groupByLimit'] : '') |
|
416 | 15 | .' BY '.implode(', ', $this->sqlParts['groupBy']); |
|
417 | |||
418 | 15 | if (!$this->sqlParts['withinGroupOrderBy']) { |
|
419 | 9 | return $sql; |
|
420 | } |
||
421 | |||
422 | 6 | $orderByParts = array(); |
|
423 | 6 | View Code Duplication | foreach ($this->sqlParts['withinGroupOrderBy'] as $orderBy) { |
424 | 6 | $orderByParts[] = $orderBy['order'].$this->getDirection($orderBy['order'], $orderBy['direction']); |
|
425 | 4 | } |
|
426 | |||
427 | 6 | return $sql.' WITHIN GROUP ORDER BY '.implode(', ', $orderByParts); |
|
428 | } |
||
429 | |||
430 | 60 | protected function buildOrderByPart() |
|
431 | { |
||
432 | 60 | if (!$this->sqlParts['orderBy']) { |
|
433 | 51 | return ''; |
|
434 | } |
||
435 | |||
436 | 9 | $orderByParts = array(); |
|
437 | 9 | View Code Duplication | foreach ($this->sqlParts['orderBy'] as $orderBy) { |
438 | 9 | $orderByParts[] = $orderBy['order'].$this->getDirection($orderBy['order'], $orderBy['direction']); |
|
439 | 6 | } |
|
440 | |||
441 | 9 | return ' ORDER BY '.implode(', ', $orderByParts); |
|
442 | } |
||
443 | |||
444 | 60 | protected function buildOptionsPart() |
|
445 | { |
||
446 | 60 | if (!$this->sqlParts['options']) { |
|
447 | 54 | return ''; |
|
448 | } |
||
449 | |||
450 | 6 | $optionsParts = array(); |
|
451 | 6 | foreach ($this->sqlParts['options'] as $option) { |
|
452 | 6 | $optionsParts[] = $option['name'].' = '.$option['value']; |
|
453 | 4 | } |
|
454 | |||
455 | 6 | return ' OPTION '.implode(', ', $optionsParts); |
|
456 | } |
||
457 | |||
458 | /** |
||
459 | * Build FACET {expr_list} [BY {expr_list}] [ORDER BY {expr | FACET()} {ASC | DESC}] [LIMIT [offset,] count]. |
||
460 | * |
||
461 | * @return string |
||
462 | */ |
||
463 | 60 | protected function buildFacetPart() |
|
464 | { |
||
465 | 60 | if (!$this->sqlParts['facet']) { |
|
466 | 57 | return ''; |
|
467 | } |
||
468 | |||
469 | 3 | $facetParts = array(); |
|
470 | 3 | foreach ($this->sqlParts['facet'] as $facet) { |
|
471 | 3 | $facetExpressions = array(); |
|
472 | 3 | foreach ($facet['facet'] as $key => $facetExpr) { |
|
473 | 3 | if (is_int($key)) { |
|
474 | 3 | $facetExpressions[] = $facetExpr; |
|
475 | 2 | } else { |
|
476 | 3 | $facetExpressions[] = $key.' AS '.$facetExpr; |
|
477 | } |
||
478 | 2 | } |
|
479 | 3 | $facetPart = 'FACET '.implode(', ', $facetExpressions); |
|
480 | 3 | if ($facet['by']) { |
|
481 | 3 | $facetPart .= ' BY '.$facet['by']; |
|
482 | 2 | } |
|
483 | 3 | if ($facet['order']) { |
|
484 | 3 | $facetPart .= ' ORDER BY '.$facet['order'].$this->getDirection($facet['order'], $facet['direction']); |
|
485 | 2 | } |
|
486 | 3 | if ($facet['limit']) { |
|
487 | $facetPart .= ' LIMIT '.(int) $facet['skip'].', '.(int) $facet['limit']; |
||
488 | } |
||
489 | |||
490 | 3 | $facetParts[] = $facetPart; |
|
491 | 2 | } |
|
492 | |||
493 | 3 | return ' '.implode(' ', $facetParts); |
|
494 | } |
||
495 | |||
496 | 18 | protected function getDirection($order, $direction) |
|
497 | { |
||
498 | 18 | if (strtoupper($direction) === 'DESC') { |
|
499 | 18 | return ' DESC'; |
|
500 | } |
||
501 | |||
502 | 15 | if (null === $direction && strtoupper($order) === 'RAND()') { |
|
503 | 3 | return ''; |
|
504 | } |
||
505 | |||
506 | 15 | return ' ASC'; |
|
507 | } |
||
508 | } |
||
509 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.