This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @处理用户中心 |
||
5 | * @license http://www.blags.org/ |
||
6 | * @created :2010年07月14日 21时54分 |
||
7 | * @copyright 1997-2010 The Martin Group |
||
8 | * @author Martin <[email protected]> |
||
9 | * */ |
||
10 | class MartinMember extends XoopsObject |
||
11 | { |
||
12 | } |
||
13 | |||
14 | /** |
||
15 | * @处理用户中心 |
||
16 | * @method: |
||
17 | * @license http://www.blags.org/ |
||
18 | * @created :2010年07月14日 21时54分 |
||
19 | * @copyright 1997-2010 The Martin Group |
||
20 | * @author Martin <[email protected]> |
||
21 | * */ |
||
22 | class MartinMemberHandler extends XoopsObjectHandler |
||
23 | { |
||
24 | /** |
||
25 | * @create cart object |
||
26 | * @license http://www.blags.org/ |
||
27 | * @created :2010年07月04日 12时59分 |
||
28 | * @copyright 1997-2010 The Martin Group |
||
29 | * @author Martin <[email protected]> |
||
30 | * */ |
||
31 | public function &create() |
||
32 | { |
||
33 | $obj =& new MartinMember; |
||
34 | |||
35 | return $obj; |
||
36 | } |
||
37 | |||
38 | /** |
||
39 | * @get rows |
||
40 | * @license http://www.blags.org/ |
||
41 | * @created :2010年06月20日 13时09分 |
||
42 | * @copyright 1997-2010 The Martin Group |
||
43 | * @author Martin <[email protected]> |
||
44 | * @param $sql |
||
45 | * @param null $key |
||
46 | * @return array |
||
47 | */ |
||
48 | View Code Duplication | public function GetRows($sql, $key = null) |
|
49 | { |
||
50 | global $xoopsDB; |
||
51 | $result = $xoopsDB->query($sql); |
||
52 | $rows = array(); |
||
53 | while ($row = $xoopsDB->fetchArray($result)) { |
||
54 | if (is_null($key)) { |
||
55 | $rows[] = $row; |
||
56 | } else { |
||
57 | $rows[$row[$key]] = $row; |
||
58 | } |
||
59 | } |
||
60 | |||
61 | return $rows; |
||
62 | } |
||
63 | |||
64 | /** |
||
65 | * @add memeber favorite hotel |
||
66 | * @method: |
||
67 | * @license http://www.blags.org/ |
||
68 | * @created :2010年07月18日 12时16分 |
||
69 | * @copyright 1997-2010 The Martin Group |
||
70 | * @author Martin <[email protected]> |
||
71 | * @param $uid |
||
72 | * @param $hotel_id |
||
73 | * @return |
||
74 | */ |
||
75 | public function AddFavorite($uid, $hotel_id) |
||
76 | { |
||
77 | $sql = "INSERT INTO {$this->db->prefix("martin_user_favorite")} (uid,hotel_id) VALUES ($uid,$hotel_id)"; |
||
78 | |||
79 | return $this->db->query($sql); |
||
80 | } |
||
81 | |||
82 | /** |
||
83 | * @ |
||
84 | * @method: |
||
85 | * @license http://www.blags.org/ |
||
86 | * @created :2010年07月18日 12时16分 |
||
87 | * @copyright 1997-2010 The Martin Group |
||
88 | * @author Martin <[email protected]> |
||
89 | * @param $start |
||
90 | * @param bool $isLived |
||
91 | * @return array |
||
92 | */ |
||
93 | public function GetHotelList($start, $isLived = false) |
||
94 | { |
||
95 | $rows = array(); |
||
96 | global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler; |
||
97 | $uid = $xoopsUser->uid(); |
||
98 | if ($isLived) { |
||
99 | $order_table = $xoopsDB->prefix('martin_order'); |
||
100 | $sql_str = "SELECT r.hotel_id FROM {$xoopsDB->prefix("martin_room")} r WHERE r.room_id IN |
||
101 | ( |
||
102 | SELECT oqr.room_id FROM {$xoopsDB->prefix("martin_order_query_room")} oqr |
||
103 | WHERE order_id IN |
||
104 | (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14) |
||
105 | UNION |
||
106 | SELECT mor.room_id FROM {$xoopsDB->prefix("martin_order_room")} mor |
||
107 | WHERE order_id IN |
||
108 | (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14) |
||
109 | )"; |
||
110 | } else { |
||
111 | $sql_str = "SELECT f.hotel_id FROM {$xoopsDB->prefix("martin_user_favorite")} f WHERE f.uid = $uid"; |
||
112 | } |
||
113 | |||
114 | //总数 |
||
115 | $sql_count = str_replace("r.hotel_id", "count(*) as count", $sql_str); |
||
116 | $sql_count = str_replace("f.hotel_id", "count(*) as count", $sql_count); |
||
117 | list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count)); |
||
118 | |||
119 | $sql = "SELECT h.hotel_id,h.hotel_alias,h.hotel_city,h.hotel_name,h.hotel_city_id |
||
120 | FROM {$xoopsDB->prefix("martin_hotel")} h WHERE h.hotel_id IN (%s) "; |
||
121 | $sql .= "GROUP BY hotel_id ORDER BY h.hotel_rank ASC "; |
||
122 | $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}"; |
||
123 | $sql = sprintf($sql, $sql_str); |
||
124 | //echo $sql; |
||
125 | $hotels = $this->GetRows($sql, 'hotel_id'); |
||
126 | $hotelAlias = $search_handler->GetCityAlias(); |
||
127 | $cityList = $hotel_handler->getCityList(); |
||
128 | if (is_array($hotels)) { |
||
129 | foreach ($hotels as $key => $value) { |
||
130 | $city_ids = explode(",", $value['hotel_city_id']); |
||
131 | foreach ($city_ids as $id) { |
||
132 | $city_name[] = $cityList[$id]; |
||
133 | } |
||
134 | $value['hotel_city_id'] = implode("、", $city_name); |
||
135 | $value['hotel_city_alias'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']]; |
||
136 | $value['url'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']] . '/' . $value['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix']; |
||
137 | $value['hotel_city'] = $cityList[$value['hotel_city']]; |
||
138 | $rows[] = $value; |
||
139 | unset($value, $city_name); |
||
140 | } |
||
141 | } |
||
142 | unset($hotelAlias, $cityList); |
||
143 | |||
144 | return $rows; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * @ |
||
149 | * @method: |
||
150 | * @license http://www.blags.org/ |
||
151 | * @created :2010年07月18日 12时16分 |
||
152 | * @copyright 1997-2010 The Martin Group |
||
153 | * @author Martin <[email protected]> |
||
154 | * @param $start |
||
155 | * @return array |
||
156 | */ |
||
157 | public function GetCouponList($start) |
||
158 | { |
||
159 | $rows = array(); |
||
0 ignored issues
–
show
|
|||
160 | global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler; |
||
161 | $table = $xoopsDB->prefix("martin_user_coupon"); |
||
162 | $uid = $xoopsUser->uid(); |
||
163 | $sql = "SELECT count(*) as count FROM $table WHERE uid = $uid"; |
||
0 ignored issues
–
show
$sql is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
164 | list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count)); |
||
165 | |||
166 | $sql = "SELECT c.*,h.hotel_name FROM $table c |
||
167 | LEFT JOIN {$xoopsDB->prefix("martin_order")} o ON (c.relation_id = o.order_id) |
||
168 | LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (o.order_id = mor.order_id) |
||
169 | LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.room_id = mor.room_id) |
||
170 | LEFT JOIN {$xoopsDB->prefix("martin_hotel")} h ON (r.hotel_id = h.hotel_id) |
||
171 | "; |
||
172 | $sql .= " WHERE o.order_uid = $uid AND c.coupon_type = 1 "; |
||
173 | $sql .= "UNION SELECT ob.*,'注册' FROM $table ob WHERE ob.coupon_type = 2 AND ob.uid = $uid "; |
||
174 | $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}"; |
||
175 | $rows = $this->GetRows($sql); |
||
176 | |||
177 | return $rows; |
||
178 | } |
||
179 | |||
180 | /** |
||
181 | * @get order hotels |
||
182 | * @method: |
||
183 | * @license http://www.blags.org/ |
||
184 | * @created :2010年07月19日 20时40分 |
||
185 | * @copyright 1997-2010 The Martin Group |
||
186 | * @author Martin <[email protected]> |
||
187 | * @param $order_ids |
||
188 | * @return array|null |
||
189 | */ |
||
190 | public function getOrderHotels($order_ids) |
||
191 | { |
||
192 | global $xoopsDB; |
||
193 | if (empty($order_ids)) { |
||
194 | return null; |
||
195 | } |
||
196 | $sql = "SELECT h.hotel_name,h.hotel_alias,h.hotel_city,mor.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h "; |
||
197 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) "; |
||
198 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) "; |
||
199 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (mor.room_id = r.room_id) "; |
||
200 | $sql .= "WHERE mor.order_id IN (" . implode(",", $order_ids) . ") GROUP BY mor.order_id "; |
||
201 | $sql .= "UNION SELECT h.hotel_name,h.hotel_alias,h.hotel_city,oqr.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h "; |
||
202 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) "; |
||
203 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) "; |
||
204 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_query_room")} oqr ON (oqr.room_id = r.room_id) "; |
||
205 | $sql .= "WHERE oqr.order_id IN (" . implode(",", $order_ids) . ") GROUP BY oqr.order_id "; |
||
206 | |||
207 | return $this->GetRows($sql, 'order_id'); |
||
208 | } |
||
209 | |||
210 | /** |
||
211 | * @ |
||
212 | * @method: |
||
213 | * @license http://www.blags.org/ |
||
214 | * @created :2010年07月19日 20时40分 |
||
215 | * @copyright 1997-2010 The Martin Group |
||
216 | * @author Martin <[email protected]> |
||
217 | * @param $order_id |
||
218 | * @param $hotel_id |
||
219 | * @return array |
||
220 | */ |
||
221 | public function GetOrderService($order_id, $hotel_id) |
||
222 | { |
||
223 | global $xoopsDB; |
||
224 | $sql = "SELECT os.*,s.*,st.*,hs.service_extra_price FROM {$xoopsDB->prefix("martin_hotel_service")} s "; |
||
225 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_order_service")} os ON (os.service_id = s.service_id) "; |
||
226 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_type")} st ON (st.service_type_id = s.service_type_id) "; |
||
227 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_relation")} hs ON (s.service_id = hs.service_id) "; |
||
228 | $sql .= "WHERE os.order_id = $order_id AND hs.hotel_id = $hotel_id "; |
||
229 | $sql .= "GROUP BY s.service_id"; |
||
230 | |||
231 | return $this->GetRows($sql, 'service_id'); |
||
232 | } |
||
233 | } |
||
234 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.