This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace PhpBoot\DB; |
||
3 | |||
4 | use PhpBoot\Application; |
||
5 | use PhpBoot\DB\rules\select\SelectRule; |
||
6 | use PhpBoot\DB\rules\insert\InsertRule; |
||
7 | use PhpBoot\DB\rules\update\UpdateRule; |
||
8 | use PhpBoot\DB\rules\delete\DeleteRule; |
||
9 | use PhpBoot\DB\rules\replace\ReplaceIntoRule; |
||
10 | use PhpBoot\Utils\Logger; |
||
11 | |||
12 | /** |
||
13 | * |
||
14 | * How-to-use: |
||
15 | * |
||
16 | * $db = new DB(...); |
||
17 | * // 1. select |
||
18 | * $res = $db->select('a, b') |
||
19 | * ->from('table') |
||
20 | * ->leftJoin('table1')->on('table.id=table1.id') |
||
21 | * ->where('a=?',1) |
||
22 | * ->groupBy('b')->having('sum(b)=?', 2) |
||
23 | * ->orderBy('c', Sql::ORDER_BY_ASC) |
||
24 | * ->limit(0,1) |
||
25 | * ->forUpdate()->of('d') |
||
26 | * ->get(); |
||
27 | * |
||
28 | * // 2. update |
||
29 | * $rows = $db->update('table') |
||
30 | * ->set('a', 1) |
||
31 | * ->where('b=?', 2) |
||
32 | * ->orderBy('c', Sql::ORDER_BY_ASC) |
||
33 | * ->limit(1) |
||
34 | * ->exec($db) |
||
35 | * ->rows |
||
36 | * |
||
37 | * // 3. insert |
||
38 | * $newId = $db->insertInto('table') |
||
39 | * ->values(['a'=>1]) |
||
40 | * ->exec($db) |
||
41 | * ->lastInsertId() |
||
42 | * |
||
43 | * //4. delete |
||
44 | * $rows = $db->deleteFrom('table') |
||
45 | * ->where('b=?', 2) |
||
46 | * ->orderBy('c', Sql::ORDER_BY_ASC) |
||
47 | * ->limit(1) |
||
48 | * ->exec($db) |
||
49 | * ->rows |
||
50 | * |
||
51 | * @author caoym <[email protected]> |
||
52 | */ |
||
53 | class DB{ |
||
54 | |||
55 | /** |
||
56 | * DB constructor. |
||
57 | * @param Application $app |
||
58 | * @param string $dsn @see \PDO |
||
59 | * @param string $username @see \PDO |
||
60 | * @param string $password @see \PDO |
||
61 | * @param array $options @see \PDO |
||
62 | */ |
||
63 | |||
64 | static public function connect(Application $app, |
||
65 | $dsn, |
||
66 | $username, |
||
67 | $password, |
||
68 | $options = []) |
||
69 | { |
||
70 | $options += [ |
||
71 | \PDO::ATTR_ERRMODE =>\PDO::ERRMODE_EXCEPTION, |
||
72 | \PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES'utf8';", |
||
73 | \PDO::MYSQL_ATTR_FOUND_ROWS => true |
||
74 | ]; |
||
75 | |||
76 | $connection = new \PDO($dsn, $username, $password, $options); |
||
77 | return new DB($app, $connection); |
||
78 | } |
||
79 | |||
80 | 56 | public function __construct(Application $app, $connection) |
|
81 | { |
||
82 | 56 | $this->app = $app; |
|
83 | 56 | $this->connection = $connection; |
|
84 | 56 | } |
|
85 | |||
86 | /** |
||
87 | * select('column0', 'column1') => "SELECT column0,column1" |
||
88 | * select(['column0', 'column1']) => "SELECT column0,column1" |
||
89 | * |
||
90 | * @param string $column0 |
||
91 | * @return \PhpBoot\DB\rules\select\FromRule |
||
92 | */ |
||
93 | 28 | function select($column0=null, $_=null){ |
|
0 ignored issues
–
show
|
|||
94 | 28 | $obj = new SelectRule(new Context($this->connection)); |
|
95 | 28 | if($column0 == null){ |
|
0 ignored issues
–
show
|
|||
96 | 9 | $args = ['*']; |
|
97 | 28 | }elseif(is_array($column0)){ |
|
98 | 3 | $args = $column0; |
|
99 | 3 | }else{ |
|
100 | 17 | $args = func_get_args(); |
|
101 | } |
||
102 | 28 | foreach ($args as &$arg){ |
|
103 | 28 | $arg = DB::wrap($arg); |
|
104 | 28 | if($arg == '*'){ |
|
105 | 16 | continue; |
|
106 | } |
||
107 | 28 | } |
|
108 | 28 | return $obj->select(implode(',', $args)); |
|
109 | } |
||
110 | /** |
||
111 | * insertInto('table') => "INSERT INTO table" |
||
112 | * |
||
113 | * @param string $table |
||
114 | * @return \PhpBoot\DB\rules\insert\ValuesRule |
||
115 | */ |
||
116 | 8 | public function insertInto($table) { |
|
117 | 8 | $obj = new InsertRule(new Context($this->connection)); |
|
118 | 8 | return $obj->insertInto($table); |
|
119 | } |
||
120 | /** |
||
121 | * update('table') => "UPDATE table" |
||
122 | * @param string $table |
||
123 | * @return \PhpBoot\DB\rules\update\UpdateSetRule |
||
124 | */ |
||
125 | 11 | public function update($table) { |
|
126 | 11 | $obj = new UpdateRule(new Context($this->connection)); |
|
127 | 11 | return $obj->update($table); |
|
128 | } |
||
129 | |||
130 | /** |
||
131 | * deleteFrom('table') => "DELETE FROM table" |
||
132 | * @param string $table |
||
133 | * @return \PhpBoot\DB\rules\basic\WhereRule |
||
134 | */ |
||
135 | 7 | public function deleteFrom($table){ |
|
136 | 7 | $obj = new DeleteRule(new Context($this->connection)); |
|
137 | 7 | return $obj->deleteFrom($table); |
|
138 | } |
||
139 | /** |
||
140 | * replaceInto('table') => "REPLACE INTO table" |
||
141 | * @param string $table |
||
142 | * @return \PhpBoot\DB\rules\replace\ValuesRule |
||
143 | */ |
||
144 | 2 | public function replaceInto($table){ |
|
145 | 2 | $obj = new ReplaceIntoRule(new Context($this->connection)); |
|
146 | 2 | return $obj->replaceInto($table); |
|
147 | } |
||
148 | |||
149 | /** |
||
150 | * @param callable $callback |
||
151 | * @return mixed return |
||
152 | * @throws \Exception |
||
153 | */ |
||
154 | public function transaction(callable $callback) |
||
155 | { |
||
156 | if($this->inTransaction){ |
||
157 | return $callback($this); |
||
158 | } |
||
159 | $this->getConnection()->beginTransaction() or \PhpBoot\abort('beginTransaction failed'); |
||
160 | $this->inTransaction = true; |
||
161 | try{ |
||
162 | $res = $callback($this); |
||
163 | $this->getConnection()->commit() or \PhpBoot\abort('commit failed'); |
||
164 | return $res; |
||
165 | }catch (\Exception $e){ |
||
166 | $this->getConnection()->rollBack(); |
||
167 | Logger::warning('commit failed with '.get_class($e).' '.$e->getMessage()); |
||
168 | throw $e; |
||
169 | } |
||
170 | } |
||
171 | /** |
||
172 | * @return \PDO |
||
173 | */ |
||
174 | public function getConnection() |
||
175 | { |
||
176 | return $this->connection; |
||
177 | } |
||
178 | /** |
||
179 | * Splice sql use raw string(without escaping) |
||
180 | * for example: |
||
181 | * where('time>?', 'now()') => " WHERE time > 'now()' " |
||
182 | * where('time>?', Sql::raw('now()')) => " WHERE time > now() " |
||
183 | * @param string $str |
||
184 | * @return Raw |
||
185 | */ |
||
186 | 13 | static public function raw($str){ |
|
187 | 13 | return new Raw($str); |
|
188 | } |
||
189 | 57 | static public function wrap($value) |
|
190 | { |
||
191 | 57 | if($value instanceof Raw){ |
|
192 | 4 | return $value->get(); |
|
193 | } |
||
194 | 57 | $value = trim($value); |
|
195 | 57 | if ($value === '*') { |
|
196 | 16 | return $value; |
|
197 | } |
||
198 | |||
199 | 56 | if(strpos($value, '.') !== false && !preg_match('/\\s+/', $value)){ |
|
200 | 1 | return $value; |
|
201 | } |
||
202 | 56 | return '`'.str_replace('`', '``', $value).'`'; |
|
203 | } |
||
204 | |||
205 | /** |
||
206 | * @return Application |
||
207 | */ |
||
208 | 11 | public function getApp() |
|
209 | { |
||
210 | 11 | return $this->app; |
|
211 | } |
||
212 | const ORDER_BY_ASC ='ASC'; |
||
213 | const ORDER_BY_DESC ='DESC'; |
||
214 | |||
215 | /** |
||
216 | * @var \PDO |
||
217 | */ |
||
218 | protected $connection; |
||
219 | |||
220 | /** |
||
221 | * @var Application |
||
222 | */ |
||
223 | protected $app; |
||
224 | |||
225 | protected $inTransaction = false; |
||
226 | } |
||
227 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.