Sql::secureBoolean() - Code Metrics - Logi-CE/fmup - Measure and Improve Code Quality continuously with Scrutinizer

Sql::secureBoolean() A
last analyzed 2017-12-05 10:44 UTC

↳ Parent: Sql

Complexity

Conditions	3
Paths	3

Size

Total Lines	12
Code Lines	8

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	3
eloc	8
nc	3
nop	1
dl	0
loc	12
rs	9.4285
c	0
b	0
f	0

<?php

/**
 * Classe fornissant des fonctions de protection des injections SQL et d'autres fonctions liées aux requetes
 * @version 1.0
 * @deprecated use \FMUP\Db instead
 */
class Sql
namespace YourVendor;

class YourClass { }
{
    /**
     * Protège des injections SQL
     * @param {string} la chaîne à sécuriser
     *
     */
    public static function sanitize($value)
    {
        $value = preg_replace('@<script[^>]*?>.*?</script>@si', '[disabled]', $value);
        return str_replace('\'', '\'\'', $value);
    }

    /**
     * Protège des injections SQL (pour les requètes)
     * @param {string} la chaîne à sécuriser
     **/
    public static function secure($value)
    {
        return "'" . Sql::sanitize($value) . "'";
    }

    /**
     * Protège des injections SQL pour les integers
     * @param {string} la chaîne à sécuriser
     **/
    public static function secureId($value)
    {
        if (Is::id($value)) {
            return $value;
        } else {
            return "null"; // entre guillements pour que ça devienne une requète SQL
        }
    }

    public static function secureListeId($value)
    {
        if ($value) {
            $values = explode(',', $value);
            $values = self::secureArray($values);
            return implode(',', $values);
        } else {
            return "0"; // entre guillements pour que ça devienne une requète SQL
        }
    }

    /**
     * Protège des injections SQL pour les integers
     * @param {string} la chaîne à sécuriser
     **/
    public static function secureInteger($value)
    {
        $value = strtr($value, ' ', '');
        if (Is::integer($value)) {
            return $value;
        } else {
            return "null"; // entre guillements pour que ça devienne une requète SQL
        }
    }

    /**
     * Protège des injections SQL pour les integers
     * @param {string} la chaîne à sécuriser
     **/
    public static function secureBoolean($value)
    {
        if (Is::integer($value)) {
            if ($value) {
                return "1";
            } else {
                return "0";
            }
        } else {
            return "0"; // entre guillements pour que ça devienne une requète SQL
        }
    }

    /**
     * Protège des injections décimales SQL en remplaçant les "," par des "."
     * @param {Decimal} le Décimal à sécuriser
     **/
    public static function secureDecimal($value)
    {
        $value = str_replace(' ', '', $value);
        if (Is::decimal($value)) {
            return str_replace(",", ".", $value);
        } else {
            return "null";
        }
    }

    /**
     * Protège des injections de date SQL en remplaçant les "" par des null
     * @param {date} lea date à sécuriser
     **/
    public static function secureDate($value)
    {
        if ($value instanceof \DateTime) {
            return '"' . $value->format('Y-m-d') . '"';
        }
        if (Is::dateTime($value) || Is::dateTimeUk($value)) {
            return "'" . $value . "'";
        } else {
            return "null";
        }
    }

    /**
     * Protège des injections SQL (pour les requètes)
     * @param {Array} le tableau à sécuriser
     **/
    public static function secureArray($values)
    {
        return array_map(array('Sql', 'secure'), $values);
    }

    public static function replaceXJoins($tabs, $orig_join, &$join = array())
    {
        foreach ($tabs as $tab) {
            if (!isset($join[$tab])) {
                if (isset($orig_join[$tab]['dep'])) {
                    self::replaceXJoins($orig_join[$tab]['dep'], $orig_join, $join);
                }
                if (isset($orig_join[$tab])) {
                    $join[$tab] = $orig_join[$tab]['join'];
                }
            }
        }
    }

    public static function replaceXFields($tab, $class = null, $option = array(), &$join = array())
    {
        if ($class) {
            $fields = call_user_func(array($class, 'xFields'), $option);
            $orig_fields = array_keys($fields);
            $dest_fields = array_values($fields);
            if (isset($option['x_joins'])) {
                $orig_join = call_user_func(array($class, 'xJoins'), $option);
            }
            foreach ($tab as $key => $value) {
                $tab[$key] = preg_replace($orig_fields, $dest_fields, trim($value));
                if (!empty($orig_join)) {
                    preg_match_all("/([[:alpha:]_]+)\./", $tab[$key], $out);
                    self::replaceXJoins($out[1], $orig_join, $join);
                }
            }
        }

        return $tab;
    }

    private static function filterWhere($i)

    {
        return $i <> "";
    }

    /**
     * Convertit un tableau de conditions en un WHERE conditions
     * Le deuxième paramètre permet de faire un HAVING à la place
     * @uses self::filterWhere
     */
    public static function parseWhere($where, $having = false, $class = null, $option = array())
    {
        $where = self::replaceXFields($where, $class, $option);

        if (!is_array($where)) {
            throw new \FMUP\Exception(
                "Erreur à l'utilisation de sqlParseWhere : tableau attendu. Reçu : " . serialize($where)
            );
        }

        $where = array_filter($where, array('\Sql', 'filterWhere'));
        if ($where == array()) {
            return "";
        } else {
            if ($having) {
                $result = " HAVING ";
            } else {
                $result = " WHERE ";
            }
            foreach ($where as $condition) {
                if ($condition != '') {
                    $result .= '(' . $condition . ') ' . "\n" . 'AND ';
                }
            }
            // suppression du dernier AND
            $result = substr($result, 0, -5);
            return $result;
        }
    }

    /*     * ********
     * Filtres *
     * ******** */

    /**
     * Cette fonction crée un tableau de conditions LIKE à partir d'un tableau
     */
    public static function conditionsFromArray($params)
    {
        $where = array();
        foreach ($params as $champ => $valeur) {
            if (0 === strpos($champ, 'id_') || $champ == 'id') {
                if ($valeur != '') {
                    $where[$champ] = "$champ = " . Sql::secureId($valeur);
                }
            } elseif (0 === strpos($champ, "date_")) {
                $where[$champ] = " CONVERT(VARCHAR, " . $champ . ", 103) LIKE '%"
                    . Sql::sanitize(trim($valeur)) . "%' ";
            } elseif (0 < strpos($champ, "chrono") && $valeur) {
                try {
                    $valeur = intval($valeur);
                } catch (Exception $e) {
                    $valeur = $valeur;

                }
                if (0 === strpos($champ, 'equal_')) {

                    $champ = substr($champ, 6);
                    $where[$champ] = "$champ LIKE '" . Sql::sanitize(trim($valeur)) . "'";
                } else {
                    $where[$champ] = "$champ LIKE '" . Sql::sanitize(trim($valeur)) . "%'";
                }
            } else {
                if ($valeur == "null") {
                    $where[$champ] = "$champ IS null";
                } elseif ($valeur == "IS NOT null") {
                    $where[$champ] = "$champ IS NOT null";
                } elseif ($valeur != '') {

                    if (0 === strpos($champ, 'equal_')) {
                        $champ = substr($champ, 6);
                        $where[$champ] = "$champ = '" . Sql::sanitize(trim($valeur)) . "'";
                    } else {
                        $where[$champ] = "$champ LIKE '%" . Sql::sanitize(trim($valeur)) . "%'";
                    }
                }
            }
        }
        return $where;
    }
}


1		<?php
2
3		/**
4		* Classe fornissant des fonctions de protection des injections SQL et d'autres fonctions liées aux requetes
5		* @version 1.0
6		* @deprecated use \FMUP\Db instead
7		*/
8		class Sql
		0 ignored issues – show Coding Style Compatibility introduced 2017-04-18 14:53 UTC by Report Bug Copy Issue Report PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions. You can fix this by adding a namespace to your class: namespace YourVendor; class YourClass { } When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries. Loading history...
9		{
10		/**
11		* Protège des injections SQL
12		* @param {string} la chaîne à sécuriser
13		*
14		*/
15		public static function sanitize($value)
16		{
17		$value = preg_replace('@<script[^>]?>.?</script>@si', '[disabled]', $value);
18		return str_replace('\'', '\'\'', $value);
19		}
20
21		/**
22		* Protège des injections SQL (pour les requètes)
23		* @param {string} la chaîne à sécuriser
24		**/
25		public static function secure($value)
26		{
27		return "'" . Sql::sanitize($value) . "'";
28		}
29
30		/**
31		* Protège des injections SQL pour les integers
32		* @param {string} la chaîne à sécuriser
33		**/
34		public static function secureId($value)
35		{
36		if (Is::id($value)) {
37		return $value;
38		} else {
39		return "null"; // entre guillements pour que ça devienne une requète SQL
40		}
41		}
42
43		public static function secureListeId($value)
44		{
45		if ($value) {
46		$values = explode(',', $value);
47		$values = self::secureArray($values);
48		return implode(',', $values);
49		} else {
50		return "0"; // entre guillements pour que ça devienne une requète SQL
51		}
52		}
53
54		/**
55		* Protège des injections SQL pour les integers
56		* @param {string} la chaîne à sécuriser
57		**/
58		public static function secureInteger($value)
59		{
60		$value = strtr($value, ' ', '');
61		if (Is::integer($value)) {
62		return $value;
63		} else {
64		return "null"; // entre guillements pour que ça devienne une requète SQL
65		}
66		}
67
68		/**
69		* Protège des injections SQL pour les integers
70		* @param {string} la chaîne à sécuriser
71		**/
72		public static function secureBoolean($value)
73		{
74		if (Is::integer($value)) {
75		if ($value) {
76		return "1";
77		} else {
78		return "0";
79		}
80		} else {
81		return "0"; // entre guillements pour que ça devienne une requète SQL
82		}
83		}
84
85		/**
86		* Protège des injections décimales SQL en remplaçant les "," par des "."
87		* @param {Decimal} le Décimal à sécuriser
88		**/
89		public static function secureDecimal($value)
90		{
91		$value = str_replace(' ', '', $value);
92		if (Is::decimal($value)) {
93		return str_replace(",", ".", $value);
94		} else {
95		return "null";
96		}
97		}
98
99		/**
100		* Protège des injections de date SQL en remplaçant les "" par des null
101		* @param {date} lea date à sécuriser
102		**/
103		public static function secureDate($value)
104		{
105		if ($value instanceof \DateTime) {
106		return '"' . $value->format('Y-m-d') . '"';
107		}
108		if (Is::dateTime($value) \|\| Is::dateTimeUk($value)) {
109		return "'" . $value . "'";
110		} else {
111		return "null";
112		}
113		}
114
115		/**
116		* Protège des injections SQL (pour les requètes)
117		* @param {Array} le tableau à sécuriser
118		**/
119		public static function secureArray($values)
120		{
121		return array_map(array('Sql', 'secure'), $values);
122		}
123
124		public static function replaceXJoins($tabs, $orig_join, &$join = array())
125		{
126		foreach ($tabs as $tab) {
127		if (!isset($join[$tab])) {
128		if (isset($orig_join[$tab]['dep'])) {
129		self::replaceXJoins($orig_join[$tab]['dep'], $orig_join, $join);
130		}
131		if (isset($orig_join[$tab])) {
132		$join[$tab] = $orig_join[$tab]['join'];
133		}
134		}
135		}
136		}
137
138		public static function replaceXFields($tab, $class = null, $option = array(), &$join = array())
139		{
140		if ($class) {
141		$fields = call_user_func(array($class, 'xFields'), $option);
142		$orig_fields = array_keys($fields);
143		$dest_fields = array_values($fields);
144		if (isset($option['x_joins'])) {
145		$orig_join = call_user_func(array($class, 'xJoins'), $option);
146		}
147		foreach ($tab as $key => $value) {
148		$tab[$key] = preg_replace($orig_fields, $dest_fields, trim($value));
149		if (!empty($orig_join)) {
150		preg_match_all("/([[:alpha:]_]+)\./", $tab[$key], $out);
151		self::replaceXJoins($out[1], $orig_join, $join);
152		}
153		}
154		}
155
156		return $tab;
157		}
158
159		private static function filterWhere($i)
		0 ignored issues – show Unused Code introduced 2017-04-18 14:53 UTC by Report Bug Copy Issue Report This method is not used, and could be removed. Loading history...
160		{
161		return $i <> "";
162		}
163
164		/**
165		* Convertit un tableau de conditions en un WHERE conditions
166		* Le deuxième paramètre permet de faire un HAVING à la place
167		* @uses self::filterWhere
168		*/
169		public static function parseWhere($where, $having = false, $class = null, $option = array())
170		{
171		$where = self::replaceXFields($where, $class, $option);
172
173		if (!is_array($where)) {
174		throw new \FMUP\Exception(
175		"Erreur à l'utilisation de sqlParseWhere : tableau attendu. Reçu : " . serialize($where)
176		);
177		}
178
179		$where = array_filter($where, array('\Sql', 'filterWhere'));
180		if ($where == array()) {
181		return "";
182		} else {
183		if ($having) {
184		$result = " HAVING ";
185		} else {
186		$result = " WHERE ";
187		}
188		foreach ($where as $condition) {
189		if ($condition != '') {
190		$result .= '(' . $condition . ') ' . "\n" . 'AND ';
191		}
192		}
193		// suppression du dernier AND
194		$result = substr($result, 0, -5);
195		return $result;
196		}
197		}
198
199		/* * ********
200		* Filtres *
201		* ******** */
202
203		/**
204		* Cette fonction crée un tableau de conditions LIKE à partir d'un tableau
205		*/
206		public static function conditionsFromArray($params)
207		{
208		$where = array();
209		foreach ($params as $champ => $valeur) {
210		if (0 === strpos($champ, 'id_') \|\| $champ == 'id') {
211		if ($valeur != '') {
212		$where[$champ] = "$champ = " . Sql::secureId($valeur);
213		}
214		} elseif (0 === strpos($champ, "date_")) {
215		$where[$champ] = " CONVERT(VARCHAR, " . $champ . ", 103) LIKE '%"
216		. Sql::sanitize(trim($valeur)) . "%' ";
217		} elseif (0 < strpos($champ, "chrono") && $valeur) {
218		try {
219		$valeur = intval($valeur);
220		} catch (Exception $e) {
221		$valeur = $valeur;
		0 ignored issues – show Bug introduced 2017-04-18 14:53 UTC by Report Bug Copy Issue Report Why assign `$valeur` to itself? This checks looks for cases where a variable has been assigned to itself. This assignement can be removed without consequences. Loading history...
222		}
223	View Code Duplication	if (0 === strpos($champ, 'equal_')) {
		0 ignored issues – show Duplication introduced 2017-04-18 14:53 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
224		$champ = substr($champ, 6);
225		$where[$champ] = "$champ LIKE '" . Sql::sanitize(trim($valeur)) . "'";
226		} else {
227		$where[$champ] = "$champ LIKE '" . Sql::sanitize(trim($valeur)) . "%'";
228		}
229		} else {
230		if ($valeur == "null") {
231		$where[$champ] = "$champ IS null";
232		} elseif ($valeur == "IS NOT null") {
233		$where[$champ] = "$champ IS NOT null";
234	View Code Duplication	} elseif ($valeur != '') {
		0 ignored issues – show Duplication introduced 2017-04-18 14:53 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
235		if (0 === strpos($champ, 'equal_')) {
236		$champ = substr($champ, 6);
237		$where[$champ] = "$champ = '" . Sql::sanitize(trim($valeur)) . "'";
238		} else {
239		$where[$champ] = "$champ LIKE '%" . Sql::sanitize(trim($valeur)) . "%'";
240		}
241		}
242		}
243		}
244		return $where;
245		}
246		}
247

Logi-CE / fmup

Sql::secureBoolean() A last analyzed 2017-12-05 10:44 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

Sql::secureBoolean() A
last analyzed 2017-12-05 10:44 UTC