Criteria::render()

Complexity

Conditions	47
Paths	1866

Size

Total Lines	181
Code Lines	89

Duplication

Lines	0
Ratio	0 %

Importance

Changes	12
Bugs	1	Features	0

<?php
    public function render(?\XoopsDatabase $db = null)
    {
        // 1) Explicit injection
        // 2) Legacy global
        // 3) Factory (if available)
        if ($db === null && isset($GLOBALS['xoopsDB']) && $GLOBALS['xoopsDB'] instanceof \XoopsDatabase) {
            $db = $GLOBALS['xoopsDB'];
        }

        if ($db === null && class_exists('\XoopsDatabaseFactory')) {
            try {
                $db = \XoopsDatabaseFactory::getDatabaseConnection();
            } catch (\Throwable $e) {
                throw new \RuntimeException('Database connection required to render Criteria: ' . $e->getMessage(), 0, $e);
            }
        }

        if (!$db) {
            throw new \RuntimeException('Database connection required to render Criteria');
        }

        $col = (string)($this->column ?? '');

        if ($col === '') {
            return '';
        }

        $backtick = (strpos($col, '.') === false && strpos($col, '(') === false) ? '`' : '';
        $clause = (empty($this->prefix) ? '' : "{$this->prefix}.") . $backtick . $col . $backtick;

        if (!empty($this->function)) {
            $clause = sprintf($this->function, $clause);
        }

        $op = strtoupper((string)$this->operator);

        // NULL operators
        if ($op === 'IS NULL' || $op === 'IS NOT NULL') {
            return $clause . ' ' . $op;
        }

        /**
         * IN / NOT IN
         */
        if ($op === 'IN' || $op === 'NOT IN') {
            // Modern safe path: array input
            if (is_array($this->value)) {
                $parts = [];
                foreach ($this->value as $v) {
                    if (is_int($v) || (is_string($v) && preg_match('/^-?\d+$/', $v))) {
                        $parts[] = (string)(int)$v;
                    } else {
                        $parts[] = $db->quote((string)$v);
                    }
                }
            return $clause . ' ' . $op . ' (' . implode(',', $parts) . ')';
        }

            // Legacy format: preformatted string in parentheses
            $legacy = (string)$this->value;

            // FIRST: strict validation of legacy syntax
            if (!self::isSafeLegacyInList($legacy)) {
                // Malformed → treat as a single literal safely
                return $clause . ' ' . $op . ' (' . $db->quote($legacy) . ')';
            }

            // If legacy logging is not enabled, just pass through
            if (!self::isLegacyLogEnabled()) {
                return $clause . ' ' . $op . ' ' . $legacy;
        }

            // Build log message
            $message = sprintf(
                'Legacy Criteria IN format used for column "%s" with value "%s"',
                $this->column,
                $legacy
            );

            // Only pay backtrace cost in debug mode
            if (defined('XOOPS_DEBUG') && XOOPS_DEBUG) {
                $bt = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 3);
                $caller = $bt[1] ?? [];
                $file = $caller['file'] ?? 'unknown';
                $line = $caller['line'] ?? 0;
                $message .= sprintf(' at %s:%d', $file, $line);
            }

            if (class_exists('XoopsLogger')) {
                \XoopsLogger::getInstance()
                            ->addExtra('CriteriaLegacyIN', $message);
        } else {
                error_log($message);
        }

            if (defined('XOOPS_DEBUG') && XOOPS_DEBUG) {
                trigger_error($message, E_USER_DEPRECATED);
            }

            return $clause . ' ' . $op . ' ' . $legacy;
        }

        // NOW it's safe to cast to string for other operators
        $valStr = (string)$this->value;

        // Empty value check
        if (trim($valStr) === '' && !$this->allowEmptyValue) {
            return '';
        }

        /**
         * LIKE / NOT LIKE
         * - Preserves leading/trailing % as wildcards
         * - Escapes inner backslashes
         * - Optionally escapes inner % and _ when allowInnerWildcards is false
         */
        if ($op === 'LIKE' || $op === 'NOT LIKE') {
            $pattern = (string)$this->value;

            // If pattern is only % signs, it's effectively "match everything" → no predicate
            if ($op === 'LIKE' && $pattern !== '' && strspn($pattern, '%') === strlen($pattern)) {
                return '';
            }

            $len     = strlen($pattern);
            $lead    = strspn($pattern, '%');
            $trail   = strspn(strrev($pattern), '%');
            $coreLen = $len - $lead - $trail;

            if ($coreLen <= 0) {
                $final = $pattern;
            } else {
                $left  = $lead > 0 ? substr($pattern, 0, $lead) : '';
                $core  = substr($pattern, $lead, $coreLen);
                $right = $trail > 0 ? substr($pattern, -$trail) : '';

                // Always escape backslashes in the core
                $core = str_replace('\\', '\\\\', $core);

                // If inner wildcards are NOT allowed, escape % and _ inside core
                if (!$this->allowInnerWildcards) {
                    $core = strtr($core, [
                        '%' => '\\%',
                        '_' => '\\_',
                    ]);
                }

                $final = $left . $core . $right;
            }

            $quoted = $db->quote($final);
            return $clause . ' ' . $op . ' ' . $quoted;
        }

        /**
         * All other operators: =, <, >, <=, >=, !=, <>
         */

        // Backtick bypass for column-to-column comparisons
        $len = strlen($valStr);
        if ($len > 2 && $valStr[0] === '`' && $valStr[$len - 1] === '`') {
            $inner = substr($valStr, 1, -1);

            // Allow alphanumeric, underscore, dot, and dollar sign
            // (valid in MySQL identifiers when backticked, incl. db.table)
            if (preg_match('/^[a-zA-Z0-9_.$\\-]+$/', $inner)) {
                $safeValue = $valStr;
        } else {
                // Old behavior: empty backticks on invalid identifier content
                $safeValue = '``';
            }
        } else {
            // Regular value - keep integers numeric; quote strings
            if (is_int($this->value) || (is_string($this->value) && preg_match('/^-?\d+$/', $this->value))) {
                $safeValue = (string)(int)$this->value;
            } else {
                $safeValue = $db->quote((string)$this->value);
            }
        }

        return $clause . ' ' . $op . ' ' . $safeValue;
    }