This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace jrdev; |
||
3 | |||
4 | class MySQL extends \MySQLi |
||
5 | { |
||
6 | private $dbConfig = array(); |
||
7 | |||
8 | private $connected = false; |
||
9 | |||
10 | private $lastError = ''; |
||
11 | |||
12 | private $tables = []; |
||
13 | |||
14 | public function __construct( |
||
15 | $host = null, |
||
16 | $username = null, |
||
17 | $password = null, |
||
18 | $dbname = null, |
||
19 | $port = null, |
||
20 | $socket = null |
||
21 | ) { |
||
22 | $this->dbConfig = [ |
||
23 | 'host' => $host ?: ini_get("mysqli.default_host"), |
||
24 | 'username' => $username ?: ini_get("mysqli.default_user"), |
||
25 | 'password' => $password ?: ini_get("mysqli.default_pw"), |
||
26 | 'dbname' => $dbname ?: '', |
||
27 | 'port' => $port ?: ini_get("mysqli.default_port"), |
||
28 | 'socket' => $socket ?: ini_get("mysqli.default_socket") |
||
29 | ]; |
||
30 | } |
||
31 | |||
32 | public function connect( |
||
0 ignored issues
–
show
|
|||
33 | $host = null, |
||
34 | $username = null, |
||
35 | $password = null, |
||
36 | $dbname = null, |
||
37 | $port = null, |
||
38 | $socket = null |
||
39 | ) { |
||
40 | if (true === $this->connected) { |
||
41 | return true; |
||
42 | } |
||
43 | |||
44 | parent::__construct( |
||
45 | $host ?: $this->dbConfig['host'], |
||
46 | $username ?: $this->dbConfig['username'], |
||
47 | $password ?: $this->dbConfig['password'], |
||
48 | $dbname ?: $this->dbConfig['dbname'], |
||
49 | $port ?: $this->dbConfig['port'], |
||
50 | $socket ?: $this->dbConfig['socket'] |
||
51 | ); |
||
52 | |||
53 | if ($this->connect_error) { |
||
54 | $this->error('MySQL Error: ' . $this->connect_errno . ' ' . $this->connect_error, true); |
||
55 | |||
56 | return false; |
||
57 | } |
||
58 | |||
59 | // It's necessary for real_escape_string. |
||
60 | if (false === $this->set_charset('utf8')) { |
||
61 | $this->error('Error loading character set utf8: ' . $this->error); |
||
62 | |||
63 | return false; |
||
64 | } |
||
65 | |||
66 | return $this->connected = true; |
||
67 | } |
||
68 | |||
69 | public function error($str = '', $fatal = false) |
||
70 | { |
||
71 | if ('' === $str) { |
||
72 | return $this->lastError; |
||
73 | } else { |
||
74 | if (true === $fatal) { |
||
75 | throw new \Exception($str); |
||
76 | } else { |
||
77 | $this->lastError = $str; |
||
78 | } |
||
79 | } |
||
80 | } |
||
81 | |||
82 | /** |
||
83 | * Performs a generic query |
||
84 | * |
||
85 | * @param string $sql |
||
86 | * @return MySQL\Result|false |
||
87 | */ |
||
88 | public function query($sql, $resultMode = MYSQLI_STORE_RESULT) |
||
89 | { |
||
90 | if (false === $this->connect()) { |
||
91 | return false; |
||
92 | } |
||
93 | |||
94 | switch ($resultMode) { |
||
95 | case MYSQLI_USE_RESULT: |
||
96 | $this->use_result(); |
||
97 | break; |
||
98 | case MYSQLI_STORE_RESULT: |
||
99 | $this->store_result(); |
||
100 | break; |
||
101 | } |
||
102 | |||
103 | if (false === $this->real_query($sql)) { |
||
104 | $this->error('Error performing query ' . $sql . ' - Error message : ' . $this->error); |
||
105 | |||
106 | return false; |
||
107 | } |
||
108 | |||
109 | return new MySQL\Result($this); |
||
110 | } |
||
111 | |||
112 | /** |
||
113 | * Performs a INSERT statement |
||
114 | * |
||
115 | * @param string $tableName |
||
116 | * @param array $fields |
||
117 | * @return int Returns the ID of the inserted row, or false on error |
||
118 | */ |
||
119 | public function insert($tableName, $fields) |
||
120 | { |
||
121 | $sql = "INSERT INTO `$tableName`" |
||
122 | . ' (`' . implode('`,`', array_keys($fields)) . '`)' |
||
123 | . ' VALUES '; |
||
124 | |||
125 | $preparedFields = array(); |
||
126 | |||
127 | foreach ($fields as $fieldValue) { |
||
128 | $preparedFields[] = $this->escape($fieldValue, true); |
||
129 | } |
||
130 | |||
131 | $sql .= '(' .implode(',', $preparedFields) . ')'; |
||
132 | |||
133 | if (false === $this->query($sql)) { |
||
134 | return false; |
||
135 | } else { |
||
136 | return $this->insert_id; |
||
137 | } |
||
138 | } |
||
139 | |||
140 | public function escape($str, $quoted = false) |
||
141 | { |
||
142 | $this->connect(); // It's necessary for real_escape_string. |
||
143 | |||
144 | $result = $this->real_escape_string($str); |
||
145 | |||
146 | return true === $quoted && preg_match('#^-?[0-9\.]+$#', $str) !== 1? "'{$result}'" : $result; |
||
147 | } |
||
148 | |||
149 | private function parseWhere($where) |
||
150 | { |
||
151 | if (is_array($where)) { |
||
152 | $fields = array(); |
||
153 | |||
154 | foreach ($where as $fieldName => $fieldValue) { |
||
155 | $fields[] = "`{$fieldName}` = " . $this->escape($fieldValue, true); |
||
156 | } |
||
157 | |||
158 | $whereSQL = implode(' AND ', $fields); |
||
159 | |||
160 | $limit = null; |
||
161 | } else { |
||
162 | if (preg_match('#^-?[0-9]+$#', $where) === 1) { |
||
163 | $whereSQL = "`id` = {$where}"; |
||
164 | |||
165 | $limit = 1; |
||
166 | } else { |
||
167 | $whereSQL = $where; |
||
168 | |||
169 | $limit = null; |
||
170 | } |
||
171 | } |
||
172 | |||
173 | return array($whereSQL, $limit); |
||
174 | } |
||
175 | |||
176 | /** |
||
177 | * Performs an UPDATE statement |
||
178 | * |
||
179 | * @param string $tableName The name of the table |
||
180 | * @param array $fields The fields to update |
||
181 | * @param mixed $where Accepts array, string and integer |
||
182 | * @param int $limit (Optional) The limit of rows to update |
||
0 ignored issues
–
show
Should the type for parameter
$limit not be integer|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
183 | * @return int Returns the number of affected rows, or false on error |
||
184 | */ |
||
185 | public function update($tableName, $fields, $where, $limit = null) |
||
186 | { |
||
187 | $sql = "UPDATE `{$tableName}` SET "; |
||
188 | |||
189 | $preparedFields = array(); |
||
190 | |||
191 | foreach ($fields as $fieldName => $fieldValue) { |
||
192 | $preparedFields[] = "`$fieldName` = " . $this->escape($fieldValue, true); |
||
193 | } |
||
194 | |||
195 | $sql .= implode(',', $preparedFields); |
||
196 | |||
197 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
198 | |||
199 | $where = $pWhere; |
||
200 | |||
201 | $sql .= " WHERE {$where}"; |
||
202 | |||
203 | if (null === $limit && null !== $pLimit) { |
||
204 | $limit = $pLimit; |
||
205 | } |
||
206 | |||
207 | if (null !== $limit) { |
||
208 | $sql .= " LIMIT {$limit}"; |
||
209 | } |
||
210 | |||
211 | if (false === $this->query($sql)) { |
||
212 | return false; |
||
213 | } else { |
||
214 | return $this->affected_rows; |
||
215 | } |
||
216 | } |
||
217 | |||
218 | /** |
||
219 | * Performs a DELETE statement |
||
220 | * |
||
221 | * @param string $tableName The name of the table |
||
222 | * @param string $where The where |
||
223 | * @param int $limit (Optional) The limit |
||
0 ignored issues
–
show
Should the type for parameter
$limit not be integer|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
224 | * @return int Returns the number of affected rows, or false on error |
||
225 | */ |
||
226 | public function delete($tableName, $where, $limit = null) |
||
227 | { |
||
228 | $sql = "DELETE FROM `{$tableName}`"; |
||
229 | |||
230 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
231 | |||
232 | $where = $pWhere; |
||
233 | |||
234 | $sql .= " WHERE {$where}"; |
||
235 | |||
236 | if (null === $limit && null !== $pLimit) { |
||
237 | $limit = $pLimit; |
||
238 | } |
||
239 | |||
240 | if (null !== $limit) { |
||
241 | $sql .= " LIMIT {$limit}"; |
||
242 | } |
||
243 | |||
244 | if (false === $this->query($sql)) { |
||
245 | return false; |
||
246 | } else { |
||
247 | return $this->affected_rows; |
||
248 | } |
||
249 | } |
||
250 | |||
251 | /** |
||
252 | * Performs a SELECT statement |
||
253 | * |
||
254 | * @param string $tableName The name of the table |
||
255 | * @param mixed $fields (Optional) The fields you want to obtain in the result. Accepts array or string |
||
256 | * @param mixed $where (Optional) The where. Accepts array, string or intenger |
||
257 | * @param string $orderBy (Optional) The order by |
||
0 ignored issues
–
show
Should the type for parameter
$orderBy not be string|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
258 | * @param int $limit (Optional) The limit |
||
0 ignored issues
–
show
Should the type for parameter
$limit not be integer|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
259 | * @return MySQL_Result |
||
0 ignored issues
–
show
|
|||
260 | */ |
||
261 | public function select($tableName, $fields = null, $where = null, $orderBy = null, $limit = null) |
||
262 | { |
||
263 | if (is_array($fields)) { |
||
264 | foreach ($fields as $key => $value) { |
||
265 | $fields[$key] = "`{$value}`"; |
||
266 | } |
||
267 | |||
268 | $fields = implode(',', $fields); |
||
269 | } elseif (is_null($fields)) { |
||
270 | $fields = '*'; |
||
271 | } |
||
272 | |||
273 | $sql = "SELECT {$fields} FROM `{$tableName}`"; |
||
274 | |||
275 | if (!is_null($where)) { |
||
276 | list($pWhere, $pLimit) = $this->parseWhere($where); |
||
277 | |||
278 | $where = $pWhere; |
||
279 | |||
280 | if (null === $limit && null !== $pLimit) { |
||
281 | $limit = $pLimit; |
||
282 | } |
||
283 | |||
284 | $sql .= " WHERE {$where}"; |
||
285 | } |
||
286 | |||
287 | if (!is_null($orderBy)) { |
||
288 | $sql .= " ORDER BY {$orderBy}"; |
||
289 | } |
||
290 | |||
291 | if (!is_null($limit)) { |
||
292 | $sql .= " LIMIT {$limit}"; |
||
293 | } |
||
294 | |||
295 | return $this->query($sql); |
||
296 | } |
||
297 | |||
298 | public function table($tableName, $tableArgs = []) |
||
299 | { |
||
300 | if (! isset($this->tables[$tableName])) { |
||
301 | $this->tables[$tableName] = new MySQL_Table($this, $tableName, $tableArgs); |
||
302 | } |
||
303 | |||
304 | return $this->tables[$tableName]; |
||
305 | } |
||
306 | |||
307 | /** |
||
308 | * Close the connection when instance is destroyed. |
||
309 | */ |
||
310 | public function __destruct() |
||
311 | { |
||
312 | if (false === $this->connected) { |
||
313 | return; |
||
314 | } |
||
315 | |||
316 | $this->close(); |
||
317 | } |
||
318 | } |
||
319 |
This check examines a number of code elements and verifies that they conform to the given naming conventions.
You can set conventions for local variables, abstract classes, utility classes, constant, properties, methods, parameters, interfaces, classes, exceptions and special methods.