MagnusGreiff /
Comment
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Anax\Database; |
||
| 4 | |||
| 5 | use \Anax\Database\Exception\Exception; |
||
| 6 | |||
| 7 | /** |
||
| 8 | * Database wrapper, provides a database API on top of PHP PDO for |
||
| 9 | * enhancing the API and dealing with error reporting and tracking. |
||
| 10 | * |
||
| 11 | *@SuppressWarnings(PHPMD.TooManyPublicMethods) |
||
| 12 | */ |
||
| 13 | class Database |
||
| 14 | { |
||
| 15 | /** |
||
| 16 | * @var array $options used when creating the PDO object |
||
| 17 | * @var PDO $pdo the PDO object |
||
| 18 | * @var PDOStatement $stmt the latest PDOStatement used |
||
| 19 | */ |
||
| 20 | protected $options; |
||
| 21 | private $pdo = null; |
||
| 22 | private $stmt = null; |
||
| 23 | |||
| 24 | |||
| 25 | |||
| 26 | /** |
||
| 27 | * Constructor creating a PDO object connecting to a choosen database. |
||
| 28 | * |
||
| 29 | * @param array $options containing details for connecting to the database. |
||
| 30 | */ |
||
| 31 | public function __construct($options = []) |
||
| 32 | { |
||
| 33 | $this->setOptions($options); |
||
| 34 | } |
||
| 35 | |||
| 36 | |||
| 37 | |||
| 38 | /** |
||
| 39 | * Set options and connection details. |
||
| 40 | * |
||
| 41 | * @param array $options containing details for connecting to the database. |
||
| 42 | * |
||
| 43 | * @return void |
||
| 44 | */ |
||
| 45 | public function setOptions($options = []) |
||
| 46 | { |
||
| 47 | $default = [ |
||
| 48 | 'dsn' => null, |
||
| 49 | 'username' => null, |
||
| 50 | 'password' => null, |
||
| 51 | 'driver_options' => null, |
||
| 52 | 'table_prefix' => null, |
||
| 53 | 'fetch_mode' => \PDO::FETCH_OBJ, |
||
| 54 | 'session_key' => 'Anax\Database', |
||
| 55 | 'verbose' => null, |
||
| 56 | 'debug_connect' => false, |
||
| 57 | ]; |
||
| 58 | $this->options = array_merge($default, $options); |
||
| 59 | } |
||
| 60 | |||
| 61 | |||
| 62 | |||
| 63 | /** |
||
| 64 | * Set a single option. |
||
| 65 | * |
||
| 66 | * @param string $option which to set. |
||
| 67 | * @param mixed $value to set. |
||
| 68 | * |
||
| 69 | * @return self |
||
| 70 | */ |
||
| 71 | public function setOption($option, $value) |
||
| 72 | { |
||
| 73 | $this->options[$option] = $value; |
||
| 74 | return $this; |
||
| 75 | } |
||
| 76 | |||
| 77 | |||
| 78 | |||
| 79 | /** |
||
| 80 | * Connect to the database, allow being called multiple times |
||
| 81 | * but ignore when connection is already made. |
||
| 82 | * |
||
| 83 | * @return self |
||
| 84 | * |
||
| 85 | * @throws \Anax\Database\Exception |
||
| 86 | */ |
||
| 87 | public function connect() |
||
| 88 | { |
||
| 89 | if ($this->pdo) { |
||
| 90 | return $this; |
||
| 91 | } |
||
| 92 | |||
| 93 | if (!isset($this->options['dsn'])) { |
||
| 94 | throw new Exception("You can not connect, missing dsn."); |
||
| 95 | } |
||
| 96 | |||
| 97 | try { |
||
| 98 | $this->pdo = new \PDO( |
||
| 99 | $this->options['dsn'], |
||
| 100 | $this->options['username'], |
||
| 101 | $this->options['password'], |
||
| 102 | $this->options['driver_options'] |
||
| 103 | ); |
||
| 104 | |||
| 105 | $this->pdo->setAttribute(\PDO::ATTR_DEFAULT_FETCH_MODE, $this->options['fetch_mode']); |
||
| 106 | $this->pdo->setAttribute(\PDO::ATTR_EMULATE_PREPARES, false); |
||
| 107 | } catch (\PDOException $e) { |
||
| 108 | if ($this->options['debug_connect']) { |
||
| 109 | throw $e; |
||
| 110 | } |
||
| 111 | throw new Exception("Could not connect to database, hiding connection details."); |
||
| 112 | } |
||
| 113 | |||
| 114 | return $this; |
||
| 115 | } |
||
| 116 | |||
| 117 | |||
| 118 | |||
| 119 | public function next() |
||
| 120 | { |
||
| 121 | return $this->stmt->nextRowSet(); |
||
| 122 | } |
||
| 123 | |||
| 124 | |||
| 125 | |||
| 126 | /** |
||
| 127 | * Support arrays in params, extract array items and add to $params |
||
| 128 | * and insert ? for each entry in the array. |
||
| 129 | * |
||
| 130 | * @param string $query as the query to prepare. |
||
| 131 | * @param array $params the parameters that may contain arrays. |
||
| 132 | * |
||
| 133 | * @return array with query and params. |
||
| 134 | */ |
||
| 135 | private function expandParamArray($query, $params) |
||
| 136 | { |
||
| 137 | $param = []; |
||
| 138 | $offset = -1; |
||
| 139 | |||
| 140 | foreach ($params as $val) { |
||
| 141 | $offset = strpos($query, '?', $offset + 1); |
||
| 142 | |||
| 143 | if (is_array($val)) { |
||
| 144 | $nrOfItems = count($val); |
||
| 145 | |||
| 146 | if ($nrOfItems) { |
||
| 147 | $query = substr($query, 0, $offset) |
||
| 148 | . str_repeat('?,', $nrOfItems - 1) |
||
| 149 | . '?' |
||
| 150 | . substr($query, $offset + 1); |
||
| 151 | $param = array_merge($param, $val); |
||
| 152 | } else { |
||
| 153 | $param[] = null; |
||
| 154 | } |
||
| 155 | } else { |
||
| 156 | $param[] = $val; |
||
| 157 | } |
||
| 158 | } |
||
| 159 | |||
| 160 | return [$query, $param]; |
||
| 161 | } |
||
| 162 | |||
| 163 | |||
| 164 | |||
| 165 | /** |
||
| 166 | * Execute a select-query with arguments and return the resultset. |
||
| 167 | * |
||
| 168 | * @param string $query the SQL statement |
||
| 169 | * @param array $params the params array |
||
| 170 | * |
||
| 171 | * @return array with resultset |
||
| 172 | */ |
||
| 173 | public function executeFetchAll($query, $params = []) |
||
| 174 | { |
||
| 175 | $this->execute($query, $params); |
||
| 176 | return $this->stmt->fetchAll(); |
||
| 177 | } |
||
| 178 | |||
| 179 | |||
| 180 | |||
| 181 | /** |
||
| 182 | * Execute a select-query with arguments and return the first row |
||
| 183 | * in the resultset. |
||
| 184 | * |
||
| 185 | * @param string $query the SQL statement |
||
| 186 | * @param array $params the params array |
||
| 187 | * |
||
| 188 | * @return array with resultset |
||
| 189 | */ |
||
| 190 | public function executeFetch($query, $params = []) |
||
| 191 | { |
||
| 192 | $this->execute($query, $params); |
||
| 193 | return $this->stmt->fetch(); |
||
| 194 | } |
||
| 195 | |||
| 196 | |||
| 197 | |||
| 198 | /** |
||
| 199 | * Execute a select-query with arguments and insert the results into |
||
| 200 | * a new object of the class. |
||
| 201 | * |
||
| 202 | * @param string $query the SQL statement |
||
| 203 | * @param array $params the params array |
||
| 204 | * @param string $class the class to create an object of and insert into |
||
| 205 | * |
||
| 206 | * @return array with resultset |
||
| 207 | */ |
||
| 208 | public function executeFetchClass($query, $params, $class) |
||
| 209 | { |
||
| 210 | $this->execute($query, $params); |
||
| 211 | $this->stmt->setFetchMode(\PDO::FETCH_CLASS, $class); |
||
| 212 | return $this->stmt->fetch(); |
||
| 213 | } |
||
| 214 | |||
| 215 | |||
| 216 | |||
| 217 | /** |
||
| 218 | * Execute a select-query with arguments and insert the results into |
||
| 219 | * an existing object. |
||
| 220 | * |
||
| 221 | * @param string $query the SQL statement |
||
| 222 | * @param array $params the params array |
||
|
0 ignored issues
–
show
|
|||
| 223 | * @param string $object the existing object to insert into |
||
| 224 | * |
||
| 225 | * @return array with resultset |
||
| 226 | */ |
||
| 227 | public function executeFetchInto($query, $param, $object = null) |
||
| 228 | { |
||
| 229 | if (!$object) { |
||
|
0 ignored issues
–
show
The expression
$object of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
Loading history...
|
|||
| 230 | $object = $param; |
||
| 231 | $param = []; |
||
| 232 | } |
||
| 233 | $this->execute($query, $param); |
||
| 234 | $this->stmt->setFetchMode(\PDO::FETCH_INTO, $object); |
||
| 235 | return $this->stmt->fetch(); |
||
| 236 | } |
||
| 237 | |||
| 238 | |||
| 239 | |||
| 240 | /** |
||
| 241 | * Fetch all resultset. |
||
| 242 | * |
||
| 243 | * @return array with resultset. |
||
| 244 | */ |
||
| 245 | public function fetchAll() |
||
| 246 | { |
||
| 247 | return $this->stmt->fetchAll(); |
||
| 248 | } |
||
| 249 | |||
| 250 | |||
| 251 | |||
| 252 | /** |
||
| 253 | * Fetch one resultset. |
||
| 254 | * |
||
| 255 | * @return array with resultset. |
||
| 256 | */ |
||
| 257 | public function fetch() |
||
| 258 | { |
||
| 259 | return $this->stmt->fetch(); |
||
| 260 | } |
||
| 261 | |||
| 262 | |||
| 263 | |||
| 264 | /** |
||
| 265 | * Fetch one resultset as a new object from this class. |
||
| 266 | * |
||
| 267 | * @param object $class which type of object to instantiate. |
||
| 268 | * |
||
| 269 | * @return array with resultset. |
||
| 270 | */ |
||
| 271 | public function fetchClass($class) |
||
| 272 | { |
||
| 273 | $this->stmt->setFetchMode(\PDO::FETCH_CLASS, $class); |
||
| 274 | return $this->stmt->fetch(); |
||
| 275 | } |
||
| 276 | |||
| 277 | |||
| 278 | |||
| 279 | /** |
||
| 280 | * Fetch full resultset as new objects from this class. |
||
| 281 | * |
||
| 282 | * @param object $class which type of object to instantiate. |
||
| 283 | * |
||
| 284 | * @return array with resultset. |
||
| 285 | */ |
||
| 286 | public function fetchAllClass($class) |
||
| 287 | { |
||
| 288 | $this->stmt->setFetchMode(\PDO::FETCH_CLASS, $class); |
||
| 289 | return $this->stmt->fetchAll(); |
||
| 290 | } |
||
| 291 | |||
| 292 | |||
| 293 | |||
| 294 | /** |
||
| 295 | * Fetch one resultset into an object. |
||
| 296 | * |
||
| 297 | * @param object $object to insert values into. |
||
| 298 | * |
||
| 299 | * @return array with resultset. |
||
| 300 | */ |
||
| 301 | public function fetchInto($object) |
||
| 302 | { |
||
| 303 | $this->stmt->setFetchMode(\PDO::FETCH_INTO, $object); |
||
| 304 | return $this->stmt->fetch(); |
||
| 305 | } |
||
| 306 | |||
| 307 | |||
| 308 | |||
| 309 | /** |
||
| 310 | * Execute a SQL-query and ignore the resultset. |
||
| 311 | * |
||
| 312 | * @param string $query the SQL statement |
||
| 313 | * @param array $params the params array |
||
| 314 | * |
||
| 315 | * @return self |
||
| 316 | * |
||
| 317 | * @throws Exception when failing to prepare question. |
||
| 318 | */ |
||
| 319 | public function execute($query, $params = []) |
||
| 320 | { |
||
| 321 | list($query, $params) = $this->expandParamArray($query, $params); |
||
| 322 | |||
| 323 | $this->stmt = $this->pdo->prepare($query); |
||
| 324 | if (!$this->stmt) { |
||
| 325 | $this->pdoException($query, $params); |
||
| 326 | } |
||
| 327 | |||
| 328 | if ($this->options["verbose"]) { |
||
| 329 | echo $query . "\n"; |
||
| 330 | print_r($params); |
||
| 331 | } |
||
| 332 | |||
| 333 | $res = $this->stmt->execute($params); |
||
| 334 | if (!$res) { |
||
| 335 | $this->statementException($query, $params); |
||
| 336 | } |
||
| 337 | |||
| 338 | return $this; |
||
| 339 | } |
||
| 340 | |||
| 341 | |||
| 342 | |||
| 343 | /** |
||
| 344 | * Throw exception using detailed message. |
||
| 345 | * |
||
| 346 | * @param string $msg detailed error message from PDO |
||
| 347 | * @param string $query query to execute |
||
| 348 | * @param array $param to match ? in statement |
||
| 349 | * |
||
| 350 | * @return void |
||
| 351 | * |
||
| 352 | * @throws \Anax\Database\Exception |
||
| 353 | */ |
||
| 354 | protected function createException($msg, $query, $param) |
||
| 355 | { |
||
| 356 | throw new Exception( |
||
| 357 | $msg |
||
| 358 | . "<br><br>SQL (" |
||
| 359 | . substr_count($query, "?") |
||
| 360 | . " params):<br><pre>$query</pre><br>PARAMS (" |
||
| 361 | . count($param) |
||
| 362 | . "):<br><pre>" |
||
| 363 | . implode($param, "\n") |
||
| 364 | . "</pre>" |
||
| 365 | . ((count(array_filter(array_keys($param), 'is_string')) > 0) |
||
| 366 | ? "WARNING your params array has keys, should only have values." |
||
| 367 | : null) |
||
| 368 | ); |
||
| 369 | } |
||
| 370 | |||
| 371 | |||
| 372 | |||
| 373 | /** |
||
| 374 | * Throw exception when pdo failed using detailed message. |
||
| 375 | * |
||
| 376 | * @param string $query query to execute |
||
| 377 | * @param array $param to match ? in statement |
||
| 378 | * |
||
| 379 | * @return void |
||
| 380 | * |
||
| 381 | * @throws \Anax\Database\Exception |
||
| 382 | */ |
||
| 383 | protected function pdoException($query, $param) |
||
| 384 | { |
||
| 385 | $this->createException($this->pdo->errorInfo()[2], $query, $param); |
||
| 386 | } |
||
| 387 | |||
| 388 | |||
| 389 | |||
| 390 | /** |
||
| 391 | * Throw exception when statement failed using detailed message. |
||
| 392 | * |
||
| 393 | * @param string $query query to execute |
||
| 394 | * @param array $param to match ? in statement |
||
| 395 | * |
||
| 396 | * @return void |
||
| 397 | * |
||
| 398 | * @throws \Anax\Database\Exception |
||
| 399 | */ |
||
| 400 | protected function statementException($query, $param) |
||
| 401 | { |
||
| 402 | $this->createException($this->stmt->errorInfo()[2], $query, $param); |
||
| 403 | } |
||
| 404 | |||
| 405 | |||
| 406 | |||
| 407 | /** |
||
| 408 | * Return last insert id from autoincremented key on INSERT. |
||
| 409 | * |
||
| 410 | * @return integer as last insert id. |
||
| 411 | */ |
||
| 412 | public function lastInsertId() |
||
| 413 | { |
||
| 414 | return $this->pdo->lastInsertId(); |
||
| 415 | } |
||
| 416 | |||
| 417 | |||
| 418 | |||
| 419 | /** |
||
| 420 | * Return rows affected of last INSERT, UPDATE, DELETE |
||
| 421 | * |
||
| 422 | * @return integer as rows affected on last statement |
||
| 423 | */ |
||
| 424 | public function rowCount() |
||
| 425 | { |
||
| 426 | return $this->stmt->rowCount(); |
||
| 427 | } |
||
| 428 | |||
| 429 | |||
| 430 | |||
| 431 | /** |
||
| 432 | * Fetch one resultset as an object from this class. |
||
| 433 | * OBSOLETE replaced by fetchClass |
||
| 434 | * |
||
| 435 | * @param object $class which type of object to instantiate. |
||
| 436 | * |
||
| 437 | * @return array with resultset. |
||
| 438 | */ |
||
| 439 | public function fetchObject($class) |
||
| 440 | { |
||
| 441 | return $this->stmt->fetchObject($class); |
||
| 442 | } |
||
| 443 | |||
| 444 | |||
| 445 | |||
| 446 | /** |
||
| 447 | * Fetch one resultset. OBSOLETE replace by fetch() |
||
| 448 | * |
||
| 449 | * @return array with resultset. |
||
| 450 | */ |
||
| 451 | public function fetchOne() |
||
| 452 | { |
||
| 453 | return $this->stmt->fetch(); |
||
| 454 | } |
||
| 455 | } |
||
| 456 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit.
Consider the following example. The parameter
$irelandis not defined by the methodfinale(...).The most likely cause is that the parameter was changed, but the annotation was not.