This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace jrdev; |
||
3 | |||
4 | class MySQL extends \MySQLi |
||
5 | { |
||
6 | private $dbConfig = array(); |
||
7 | |||
8 | private $connected = false; |
||
9 | |||
10 | private $lastError = ''; |
||
11 | |||
12 | private $tables = []; |
||
13 | |||
14 | public function __construct( |
||
15 | $host = null, |
||
16 | $username = null, |
||
17 | $password = null, |
||
18 | $dbname = null, |
||
19 | $port = null, |
||
20 | $socket = null |
||
21 | ) { |
||
22 | $this->dbConfig = [ |
||
23 | 'host' => $host ?: ini_get("mysqli.default_host"), |
||
24 | 'username' => $username ?: ini_get("mysqli.default_user"), |
||
25 | 'password' => $password ?: ini_get("mysqli.default_pw"), |
||
26 | 'dbname' => $dbname ?: '', |
||
27 | 'port' => $port ?: ini_get("mysqli.default_port"), |
||
28 | 'socket' => $socket ?: ini_get("mysqli.default_socket") |
||
29 | ]; |
||
30 | } |
||
31 | |||
32 | public function connect( |
||
33 | $host = null, |
||
34 | $username = null, |
||
35 | $password = null, |
||
36 | $dbname = null, |
||
37 | $port = null, |
||
38 | $socket = null |
||
39 | ) { |
||
40 | if (true === $this->connected) { |
||
41 | return true; |
||
42 | } |
||
43 | |||
44 | parent::__construct( |
||
0 ignored issues
–
show
|
|||
45 | $host ?: $this->dbConfig['host'], |
||
46 | $username ?: $this->dbConfig['username'], |
||
47 | $password ?: $this->dbConfig['password'], |
||
48 | $dbname ?: $this->dbConfig['dbname'], |
||
49 | $port ?: $this->dbConfig['port'], |
||
50 | $socket ?: $this->dbConfig['socket'] |
||
51 | ); |
||
52 | |||
53 | if ($this->connect_error) { |
||
54 | $this->error('MySQL Error: ' . $this->connect_errno . ' ' . $this->connect_error, true); |
||
55 | |||
56 | return false; |
||
57 | } |
||
58 | |||
59 | // It's necessary for real_escape_string. |
||
60 | if (false === $this->set_charset('utf8')) { |
||
61 | $this->error('Error loading character set utf8: ' . $this->error); |
||
62 | |||
63 | return false; |
||
64 | } |
||
65 | |||
66 | return $this->connected = true; |
||
67 | } |
||
68 | |||
69 | public function error($str = '', $fatal = false) |
||
70 | { |
||
71 | if ('' === $str) { |
||
72 | return $this->lastError; |
||
73 | } else { |
||
74 | if (true === $fatal) { |
||
75 | throw new \Exception($str); |
||
76 | } else { |
||
77 | $this->lastError = $str; |
||
78 | } |
||
79 | } |
||
80 | } |
||
81 | |||
82 | /** |
||
83 | * Performs a generic query |
||
84 | * |
||
85 | * @param string $sql |
||
86 | * @return MySQL\Result|false |
||
87 | */ |
||
88 | public function query($sql, $resultMode = MYSQLI_STORE_RESULT) |
||
89 | { |
||
90 | if (false === $this->connect()) { |
||
91 | return false; |
||
92 | } |
||
93 | |||
94 | switch ($resultMode) { |
||
95 | case MYSQLI_USE_RESULT: |
||
96 | $this->use_result(); |
||
97 | break; |
||
98 | case MYSQLI_STORE_RESULT: |
||
99 | $this->store_result(); |
||
100 | break; |
||
101 | } |
||
102 | |||
103 | if (false === $this->real_query($sql)) { |
||
104 | $this->error('Error performing query ' . $sql . ' - Error message : ' . $this->error); |
||
105 | |||
106 | return false; |
||
107 | } |
||
108 | |||
109 | return new MySQL\Result($this); |
||
110 | } |
||
111 | |||
112 | /** |
||
113 | * Performs a INSERT statement |
||
114 | * |
||
115 | * @param string $tableName |
||
116 | * @param array $fields |
||
117 | * @return int Returns the ID of the inserted row, or false on error |
||
118 | */ |
||
119 | public function insert($tableName, $fields) |
||
120 | { |
||
121 | $sql = "INSERT INTO `$tableName`" |
||
122 | . ' (`' . implode('`,`', array_keys($fields)) . '`)' |
||
123 | . ' VALUES '; |
||
124 | |||
125 | $preparedFields = array(); |
||
126 | |||
127 | foreach ($fields as $fieldValue) { |
||
128 | $preparedFields[] = $this->escape($fieldValue, true); |
||
129 | } |
||
130 | |||
131 | $sql .= '(' .implode(',', $preparedFields) . ')'; |
||
132 | |||
133 | if (false === $this->query($sql)) { |
||
134 | return false; |
||
135 | } else { |
||
136 | return $this->insert_id; |
||
137 | } |
||
138 | } |
||
139 | |||
140 | public function escape($str, $quoted = false) |
||
141 | { |
||
142 | $this->connect(); // It's necessary for real_escape_string. |
||
143 | |||
144 | $result = $this->real_escape_string($str); |
||
145 | |||
146 | return true === $quoted && preg_match('#^-?[0-9\.]+$#', $str) !== 1? "'{$result}'" : $result; |
||
147 | } |
||
148 | |||
149 | private function parseWhere($where) |
||
150 | { |
||
151 | if (is_array($where)) { |
||
152 | $fields = array(); |
||
153 | |||
154 | foreach ($where as $fieldName => $fieldValue) { |
||
155 | $fields[] = "`{$fieldName}` = " . $this->escape($fieldValue, true); |
||
156 | } |
||
157 | |||
158 | $whereSQL = implode(' AND ', $fields); |
||
159 | |||
160 | $limit = null; |
||
161 | } else { |
||
162 | if (preg_match('#^-?[0-9]+$#', $where) === 1) { |
||
163 | $whereSQL = "`id` = {$where}"; |
||
164 | |||
165 | $limit = 1; |
||
166 | } else { |
||
167 | $whereSQL = $where; |
||
168 | |||
169 | $limit = null; |
||
170 | } |
||
171 | } |
||
172 | |||
173 | return array($whereSQL, $limit); |
||
174 | } |
||
175 | |||
176 | /** |
||
177 | * Performs an UPDATE statement |
||
178 | * |
||
179 | * @param string $tableName The name of the table |
||
180 | * @param array $fields The fields to update |
||
181 | * @param mixed $where Accepts array, string and integer |
||
182 | * @param int $limit (Optional) The limit of rows to update |
||
183 | * @return int Returns the number of affected rows, or false on error |
||
184 | */ |
||
185 | public function update($tableName, $fields, $where, $limit = null) |
||
186 | { |
||
187 | $sql = "UPDATE `{$tableName}` SET "; |
||
188 | |||
189 | $preparedFields = array(); |
||
190 | |||
191 | foreach ($fields as $fieldName => $fieldValue) { |
||
192 | $preparedFields[] = "`$fieldName` = " . $this->escape($fieldValue, true); |
||
193 | } |
||
194 | |||
195 | $sql .= implode(',', $preparedFields); |
||
196 | |||
197 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
198 | |||
199 | $where = $pWhere; |
||
200 | |||
201 | $sql .= " WHERE {$where}"; |
||
202 | |||
203 | if (null === $limit && null !== $pLimit) { |
||
204 | $limit = $pLimit; |
||
205 | } |
||
206 | |||
207 | if (null !== $limit) { |
||
208 | $sql .= " LIMIT {$limit}"; |
||
209 | } |
||
210 | |||
211 | if (false === $this->query($sql)) { |
||
212 | return false; |
||
213 | } else { |
||
214 | return $this->affected_rows; |
||
215 | } |
||
216 | } |
||
217 | |||
218 | /** |
||
219 | * Performs a DELETE statement |
||
220 | * |
||
221 | * @param string $tableName The name of the table |
||
222 | * @param string $where The where |
||
223 | * @param int $limit (Optional) The limit |
||
224 | * @return int Returns the number of affected rows, or false on error |
||
225 | */ |
||
226 | public function delete($tableName, $where, $limit = null) |
||
227 | { |
||
228 | $sql = "DELETE FROM `{$tableName}`"; |
||
229 | |||
230 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
231 | |||
232 | $where = $pWhere; |
||
233 | |||
234 | $sql .= " WHERE {$where}"; |
||
235 | |||
236 | if (null === $limit && null !== $pLimit) { |
||
237 | $limit = $pLimit; |
||
238 | } |
||
239 | |||
240 | if (null !== $limit) { |
||
241 | $sql .= " LIMIT {$limit}"; |
||
242 | } |
||
243 | |||
244 | if (false === $this->query($sql)) { |
||
245 | return false; |
||
246 | } else { |
||
247 | return $this->affected_rows; |
||
248 | } |
||
249 | } |
||
250 | |||
251 | /** |
||
252 | * Performs a SELECT statement |
||
253 | * |
||
254 | * @param string $tableName The name of the table |
||
255 | * @param mixed $fields (Optional) The fields you want to obtain in the result. Accepts array or string |
||
256 | * @param mixed $where (Optional) The where. Accepts array, string or intenger |
||
257 | * @param string $orderBy (Optional) The order by |
||
258 | * @param int $limit (Optional) The limit |
||
259 | * @return MySQL_Result |
||
260 | */ |
||
261 | public function select($tableName, $fields = null, $where = null, $orderBy = null, $limit = null) |
||
262 | { |
||
263 | if (is_array($fields)) { |
||
264 | foreach ($fields as $key => $value) { |
||
265 | $fields[$key] = "`{$value}`"; |
||
266 | } |
||
267 | |||
268 | $fields = implode(',', $fields); |
||
269 | } elseif (is_null($fields)) { |
||
270 | $fields = '*'; |
||
271 | } |
||
272 | |||
273 | $sql = "SELECT {$fields} FROM `{$tableName}`"; |
||
274 | |||
275 | if (!is_null($where)) { |
||
276 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
277 | |||
278 | $where = $pWhere; |
||
279 | |||
280 | if (null === $limit && null !== $pLimit) { |
||
281 | $limit = $pLimit; |
||
282 | } |
||
283 | |||
284 | $sql .= " WHERE {$where}"; |
||
285 | } |
||
286 | |||
287 | if (!is_null($orderBy)) { |
||
288 | $sql .= " ORDER BY {$orderBy}"; |
||
289 | } |
||
290 | |||
291 | if (!is_null($limit)) { |
||
292 | $sql .= " LIMIT {$limit}"; |
||
293 | } |
||
294 | |||
295 | return $this->query($sql); |
||
296 | } |
||
297 | |||
298 | public function table($tableName, $tableArgs = []) |
||
299 | { |
||
300 | if (! isset($this->tables[$tableName])) { |
||
301 | $this->tables[$tableName] = new MySQL_Table($this, $tableName, $tableArgs); |
||
302 | } |
||
303 | |||
304 | return $this->tables[$tableName]; |
||
305 | } |
||
306 | |||
307 | /** |
||
308 | * Close the connection when instance is destroyed. |
||
309 | */ |
||
310 | public function __destruct() |
||
311 | { |
||
312 | if (false === $this->connected) { |
||
313 | return; |
||
314 | } |
||
315 | |||
316 | $this->close(); |
||
317 | } |
||
318 | } |
||
319 |
This check looks for a call to a parent method whose name is different than the method from which it is called.
Consider the following code:
The
getFirstName()
method in theSon
calls the wrong method in the parent class.