main/admin/user_list.php ➔ prepare_user_sql_query()

Complexity

Conditions	28
Paths	2016

Size

Total Lines	124
Code Lines	79

Duplication

Lines	0
Ratio	0 %

<?php
function prepare_user_sql_query($is_count)
{
    $sql = "";
    $user_table = Database::get_main_table(TABLE_MAIN_USER);
    $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);

    if ($is_count) {
        $sql .= "SELECT COUNT(u.id) AS total_number_of_items FROM $user_table u";
    } else {
        $sql .= "SELECT u.id AS col0, u.official_code AS col2, ";

        if (api_is_western_name_order()) {
            $sql .= "u.firstname AS col3, u.lastname AS col4, ";
        } else {
            $sql .= "u.lastname AS col3, u.firstname AS col4, ";
        }

        $sql .= " u.username AS col5,
                    u.email AS col6,
                    u.status AS col7,
                    u.active AS col8,
                    u.id AS col9,
                    u.registration_date AS col10,
                    u.expiration_date AS exp,
                    u.password
                FROM $user_table u";
    }

    // adding the filter to see the user's only of the current access_url
    if ((api_is_platform_admin() || api_is_session_admin()) && api_get_multiple_access_url()) {
        $access_url_rel_user_table = Database :: get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
        $sql.= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.id=url_rel_user.user_id)";
    }

    $keywordList = array(
        'keyword_firstname',
        'keyword_lastname',
        'keyword_username',
        'keyword_email',
        'keyword_officialcode',
        'keyword_status',
        'keyword_active',
        'check_easy_passwords'
    );

    $keywordListValues = array();
    $atLeastOne = false;
    foreach ($keywordList as $keyword) {
        $keywordListValues[$keyword] = null;
        if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {
            $keywordListValues[$keyword] = $_GET[$keyword];
            $atLeastOne = true;
        }
    }

    if ($atLeastOne == false) {
        $keywordListValues = array();
    }

    if (isset($keyword_extra_data) && !empty($keyword_extra_data)) {

The variable $keyword_extra_data seems to never exist, and therefore isset should always return false. Did you maybe rename this variable?

        $extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
        $field_id = $extra_info['id'];
        $sql.= " INNER JOIN user_field_values ufv ON u.id=ufv.user_id AND ufv.field_id=$field_id ";
    }

    if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {
        $keywordFiltered = Database::escape_string("%". $_GET['keyword'] ."%");
        $sql .= " WHERE (
                    u.firstname LIKE '$keywordFiltered' OR
                    u.lastname LIKE '$keywordFiltered' OR
                    concat(u.firstname, ' ', u.lastname) LIKE '$keywordFiltered' OR
                    concat(u.lastname,' ',u.firstname) LIKE '$keywordFiltered' OR
                    u.username LIKE '$keywordFiltered' OR
                    u.official_code LIKE '$keywordFiltered' OR
                    u.email LIKE '$keywordFiltered'
                )
        ";
    } elseif (isset($keywordListValues) && !empty($keywordListValues)) {
        $query_admin_table = '';
        $keyword_admin = '';

        if (isset($keywordListValues['keyword_status']) &&
            $keywordListValues['keyword_status'] == PLATFORM_ADMIN
        ) {
            $query_admin_table = " , $admin_table a ";
            $keyword_admin = ' AND a.user_id = u.id ';
            $keywordListValues['keyword_status'] = '%';
        }

        $keyword_extra_value = '';
        if (isset($keyword_extra_data) && !empty($keyword_extra_data) &&
            !empty($keyword_extra_data_text)) {

The variable $keyword_extra_data_text seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
        }

        $sql .= " $query_admin_table
                WHERE (
                    u.firstname LIKE '". Database::escape_string("%".$keywordListValues['keyword_firstname']."%")."' AND
                    u.lastname LIKE '". Database::escape_string("%".$keywordListValues['keyword_lastname']."%")."' AND
                    u.username LIKE '". Database::escape_string("%".$keywordListValues['keyword_username']."%")."' AND
                    u.email LIKE '". Database::escape_string("%".$keywordListValues['keyword_email']."%")."' AND
                    u.official_code LIKE '". Database::escape_string("%".$keywordListValues['keyword_officialcode']."%")."' AND
                    u.status LIKE '".Database::escape_string($keywordListValues['keyword_status'])."'
                    $keyword_admin
                    $keyword_extra_value
                ";

        if (isset($keyword_active) && !isset($keyword_inactive)) {

The variable $keyword_inactive seems to never exist, and therefore isset should always return false. Did you maybe rename this variable?

            $sql .= " AND u.active='1'";
        } elseif (isset($keyword_inactive) && !isset($keyword_active)) {

The variable $keyword_active seems to never exist, and therefore isset should always return false. Did you maybe rename this variable?

            $sql .= " AND u.active='0'";
        }
        $sql .= " ) ";
    }

    // adding the filter to see the user's only of the current access_url
    if ((api_is_platform_admin() || api_is_session_admin())
        && api_get_multiple_access_url()
    ) {
        $sql .= " AND url_rel_user.access_url_id=".api_get_current_access_url_id();
    }

    return $sql;
}