This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @package A simple ORM that performs basic CRUD operations |
||
5 | * @author Surajudeen AKANDE <[email protected]> |
||
6 | * @license MIT <https://opensource.org/licenses/MIT> |
||
7 | * @link http://www.github.com/andela-sakande |
||
8 | * |
||
9 | */ |
||
10 | |||
11 | namespace Sirolad; |
||
12 | |||
13 | use PDO; |
||
14 | use PDOException; |
||
15 | use Sirolad\DB\DBConnect; |
||
16 | use Sirolad\Libraries\Formatter; |
||
17 | use Sirolad\Libraries\TableMapper; |
||
18 | use Sirolad\Interfaces\PotatoInterface; |
||
19 | use Sirolad\Exceptions\EmptyTableException; |
||
20 | use Sirolad\Exceptions\RecordNotFoundException; |
||
21 | use Sirolad\Exceptions\TableDoesNotExistException; |
||
22 | |||
23 | /** |
||
24 | * Potato is the main class which is not to be instantiated. |
||
25 | * */ |
||
26 | class Potato implements PotatoInterface |
||
27 | { |
||
28 | /** |
||
29 | * @var array Array for holding properties set with magic method __set() |
||
30 | */ |
||
31 | protected $record = []; |
||
32 | |||
33 | /** |
||
34 | * Set property dynamically |
||
35 | * |
||
36 | * @param string $field Property set dynamically |
||
37 | * @param string $value Value of property set dynamically |
||
38 | */ |
||
39 | public function __set($field, $value) |
||
40 | { |
||
41 | $this->record[$field] = $value; |
||
42 | } |
||
43 | |||
44 | /** |
||
45 | * @param string connection to class name |
||
46 | * @return string table name of Called class |
||
47 | */ |
||
48 | public function tableName() |
||
49 | { |
||
50 | return TableMapper::getClassName(get_called_class()); |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * Provide a read access to protected $record array |
||
55 | * |
||
56 | * @return array $record Array of variables set dynamically with method __set() |
||
57 | */ |
||
58 | public function getRecord() |
||
59 | { |
||
60 | return $this->record; |
||
61 | } |
||
62 | |||
63 | /** |
||
64 | * @return object Database connection |
||
65 | */ |
||
66 | protected function makeDbConn() |
||
67 | { |
||
68 | $getConn = new DBConnect(); |
||
69 | return $getConn->getConnection(); |
||
70 | } |
||
71 | |||
72 | /** |
||
73 | * Get a distinct record from the database |
||
74 | * |
||
75 | * @param int $record Index of record to get |
||
76 | * @return string|object |
||
77 | */ |
||
78 | public function find($record) |
||
79 | { |
||
80 | return self::where('id', $record); |
||
81 | } |
||
82 | |||
83 | /** |
||
84 | * Get a record in the database |
||
85 | * |
||
86 | * @param string $field Field name to search under |
||
87 | * @param string $value Field value to search for |
||
88 | * @return string|object |
||
89 | */ |
||
90 | public function where($field, $value) |
||
91 | { |
||
92 | try { |
||
93 | $dbConnect = self::makeDbConn(); |
||
94 | $sql = 'SELECT * FROM ' . self::tableName() . ' WHERE ' . $field . ' = ?'; |
||
95 | $query = $dbConnect->prepare($sql); |
||
96 | $query->execute([$value]); |
||
97 | if ($query->rowCount() > 0) { |
||
98 | $found = new static; |
||
99 | $found->dbData = $query->fetch(PDO::FETCH_ASSOC); |
||
100 | |||
101 | return $found; |
||
102 | } else { |
||
103 | throw new RecordNotFoundException; |
||
104 | } |
||
105 | } catch (RecordNotFoundException $e) { |
||
106 | return $e->message(); |
||
107 | } |
||
108 | finally { |
||
109 | $dbConnect = null; |
||
0 ignored issues
–
show
|
|||
110 | } |
||
111 | } |
||
112 | |||
113 | /** |
||
114 | * Get all the records in a database table |
||
115 | * @return array|object |
||
116 | * @return exception |
||
117 | */ |
||
118 | public function getAll() |
||
119 | { |
||
120 | try { |
||
121 | $dbConn = self::makeDbConn(); |
||
122 | $query = $dbConn->prepare('SELECT * FROM ' . self::tableName()); |
||
123 | $query->execute(); |
||
124 | |||
125 | if ($query->rowCount()) { |
||
126 | return json_encode($query->fetchAll(PDO::FETCH_ASSOC), JSON_FORCE_OBJECT); |
||
127 | } else { |
||
128 | throw new EmptyTableException; |
||
129 | } |
||
130 | } catch (PDOException $e) { |
||
131 | return $e->getMessage(); |
||
132 | } |
||
133 | finally { |
||
134 | $dbConn = null; |
||
0 ignored issues
–
show
$dbConn is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
135 | } |
||
136 | } |
||
137 | |||
138 | /** |
||
139 | * Insert or Update a record in a database table |
||
140 | * @return inte |
||
141 | * @return exception |
||
142 | */ |
||
143 | public function save() |
||
144 | { |
||
145 | try { |
||
146 | $dbConn = self::makeDbConn(); |
||
147 | |||
148 | if (isset($this->record['dbData']) && is_array($this->record['dbData'])) { |
||
149 | $sql = 'UPDATE ' . $this->tableName() . ' SET ' . Formatter::tokenize(implode(',', Formatter::makeAssociativeArray($this->record)), ',') . ' WHERE id=' . $this->record['dbData']['id']; |
||
150 | $query = $dbConn->prepare($sql); |
||
151 | $query->execute(); |
||
152 | } else { |
||
153 | $sql = 'INSERT INTO ' . $this->tableName() . ' (' . Formatter::tokenize(implode(',', array_keys($this->record)), ',') . ')' . ' VALUES ' . '(' . Formatter::tokenize(implode(',', Formatter::generateUnnamedPlaceholders($this->record)), ',') . ')'; |
||
154 | $query = $dbConn->prepare($sql); |
||
155 | $query->execute(array_values($this->record)); |
||
156 | } |
||
157 | } catch (PDOException $e) { |
||
158 | return $e->getMessage(); |
||
159 | } catch (RecordNotFoundException $e) { |
||
160 | return $e->message(); |
||
161 | } |
||
162 | finally { |
||
163 | $dbConn = null; |
||
0 ignored issues
–
show
$dbConn is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
164 | } |
||
165 | |||
166 | return $query->rowCount(); |
||
167 | } |
||
168 | |||
169 | /** |
||
170 | * Delete a record from the database table |
||
171 | * @param int $record Index of record to be deleted |
||
172 | * @return bool|string |
||
173 | * @return exception |
||
174 | */ |
||
175 | public function destroy($record) |
||
176 | { |
||
177 | try { |
||
178 | $dbConn = self::makeDbConn(); |
||
179 | $query = $dbConn->prepare('DELETE FROM ' . self::tableName($dbConn) . ' WHERE id= ' . $record); |
||
0 ignored issues
–
show
The call to
Potato::tableName() has too many arguments starting with $dbConn .
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the ![]() |
|||
180 | $query->execute(); |
||
181 | $check = $query->rowCount(); |
||
182 | if ($check) { |
||
183 | return $check; |
||
184 | } else { |
||
185 | throw new RecordNotFoundException; |
||
186 | } |
||
187 | } catch (PDOException $e) { |
||
188 | echo $e->getMessage(); |
||
189 | } |
||
190 | finally { |
||
191 | $dbConn = null; |
||
0 ignored issues
–
show
$dbConn is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
192 | } |
||
193 | } |
||
194 | } |
||
195 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.