Issues in member.php (master) - Issues in master - mambax7/xoops-martin - Measure and Improve Code Quality continuously with Scrutinizer

Issues (663)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/member.php (7 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * @处理用户中心
 * @license   http://www.blags.org/
 * @created   :2010年07月14日 21时54分
 * @copyright 1997-2010 The Martin Group
 * @author    Martin <[email protected]>
 * */
class MartinMember extends XoopsObject
{
}

/**
 * @处理用户中心
 * @method:
 * @license   http://www.blags.org/
 * @created   :2010年07月14日 21时54分
 * @copyright 1997-2010 The Martin Group
 * @author    Martin <[email protected]>
 * */
class MartinMemberHandler extends XoopsObjectHandler
{
    /**
     * @create    cart object
     * @license   http://www.blags.org/
     * @created   :2010年07月04日 12时59分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * */
    public function &create()
    {
        $obj =& new MartinMember;

        return $obj;
    }

    /**
     * @get       rows
     * @license   http://www.blags.org/
     * @created   :2010年06月20日 13时09分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param      $sql
     * @param null $key
     * @return array
     */
    public function GetRows($sql, $key = null)

    {
        global $xoopsDB;
        $result = $xoopsDB->query($sql);
        $rows   = array();
        while ($row = $xoopsDB->fetchArray($result)) {
            if (is_null($key)) {
                $rows[] = $row;
            } else {
                $rows[$row[$key]] = $row;
            }
        }

        return $rows;
    }

    /**
     * @add       memeber favorite hotel
     * @method:
     * @license   http://www.blags.org/
     * @created   :2010年07月18日 12时16分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param $uid
     * @param $hotel_id
     * @return
     */
    public function AddFavorite($uid, $hotel_id)

    {
        $sql = "INSERT INTO {$this->db->prefix("martin_user_favorite")} (uid,hotel_id) VALUES ($uid,$hotel_id)";

        return $this->db->query($sql);
    }

    /**
     * @
     * @method:
     * @license   http://www.blags.org/
     * @created   :2010年07月18日 12时16分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param      $start
     * @param bool $isLived
     * @return array
     */
    public function GetHotelList($start, $isLived = false)
    {
        $rows = array();
        global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler;
        $uid = $xoopsUser->uid();
        if ($isLived) {
            $order_table = $xoopsDB->prefix('martin_order');
            $sql_str     = "SELECT r.hotel_id FROM {$xoopsDB->prefix("martin_room")} r WHERE r.room_id IN
				(
				 SELECT oqr.room_id FROM {$xoopsDB->prefix("martin_order_query_room")} oqr 
				 WHERE order_id IN 
				 (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14) 
				 UNION 
				 SELECT mor.room_id FROM {$xoopsDB->prefix("martin_order_room")} mor 
				 WHERE order_id IN 
				 (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14)
				)";
        } else {
            $sql_str = "SELECT f.hotel_id FROM {$xoopsDB->prefix("martin_user_favorite")} f WHERE f.uid = $uid";
        }

        //总数
        $sql_count = str_replace("r.hotel_id", "count(*) as count", $sql_str);
        $sql_count = str_replace("f.hotel_id", "count(*) as count", $sql_count);
        list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count));

        $sql = "SELECT h.hotel_id,h.hotel_alias,h.hotel_city,h.hotel_name,h.hotel_city_id 
				FROM {$xoopsDB->prefix("martin_hotel")} h WHERE h.hotel_id IN (%s) ";
        $sql .= "GROUP BY hotel_id ORDER BY h.hotel_rank ASC ";
        $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}";
        $sql = sprintf($sql, $sql_str);
        //echo $sql;
        $hotels     = $this->GetRows($sql, 'hotel_id');
        $hotelAlias = $search_handler->GetCityAlias();
        $cityList   = $hotel_handler->getCityList();
        if (is_array($hotels)) {
            foreach ($hotels as $key => $value) {
                $city_ids = explode(",", $value['hotel_city_id']);
                foreach ($city_ids as $id) {
                    $city_name[] = $cityList[$id];
foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}
                }
                $value['hotel_city_id']    = implode("、", $city_name);
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                $value['hotel_city_alias'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']];
                $value['url']              = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']] . '/' . $value['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix'];
                $value['hotel_city']       = $cityList[$value['hotel_city']];
                $rows[]                    = $value;
                unset($value, $city_name);
            }
        }
        unset($hotelAlias, $cityList);

        return $rows;
    }

    /**
     * @
     * @method:
     * @license   http://www.blags.org/
     * @created   :2010年07月18日 12时16分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param $start
     * @return array
     */
    public function GetCouponList($start)
    {
        $rows = array();
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
        global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler;
        $table = $xoopsDB->prefix("martin_user_coupon");
        $uid   = $xoopsUser->uid();
        $sql   = "SELECT count(*) as count FROM $table WHERE uid = $uid";
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
        list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count));


        $sql = "SELECT c.*,h.hotel_name FROM $table c 
				LEFT JOIN {$xoopsDB->prefix("martin_order")} o ON (c.relation_id = o.order_id)
				LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (o.order_id = mor.order_id)
				LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.room_id = mor.room_id)
				LEFT JOIN {$xoopsDB->prefix("martin_hotel")} h ON (r.hotel_id = h.hotel_id)
			 ";
        $sql .= " WHERE o.order_uid = $uid AND c.coupon_type = 1 ";
        $sql .= "UNION SELECT ob.*,'注册' FROM $table ob WHERE ob.coupon_type = 2 AND ob.uid = $uid ";
        $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}";
        $rows = $this->GetRows($sql);

        return $rows;
    }

    /**
     * @get       order hotels
     * @method:
     * @license   http://www.blags.org/
     * @created   :2010年07月19日 20时40分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param $order_ids
     * @return array|null
     */
    public function getOrderHotels($order_ids)
    {
        global $xoopsDB;
        if (empty($order_ids)) {
            return null;
        }
        $sql = "SELECT h.hotel_name,h.hotel_alias,h.hotel_city,mor.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (mor.room_id = r.room_id) ";
        $sql .= "WHERE mor.order_id IN	(" . implode(",", $order_ids) . ") GROUP BY mor.order_id ";
        $sql .= "UNION SELECT h.hotel_name,h.hotel_alias,h.hotel_city,oqr.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) ";
        $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_query_room")} oqr ON (oqr.room_id = r.room_id) ";
        $sql .= "WHERE oqr.order_id IN	(" . implode(",", $order_ids) . ") GROUP BY oqr.order_id ";

        return $this->GetRows($sql, 'order_id');
    }

    /**
     * @
     * @method:
     * @license   http://www.blags.org/
     * @created   :2010年07月19日 20时40分
     * @copyright 1997-2010 The Martin Group
     * @author    Martin <[email protected]>
     * @param $order_id
     * @param $hotel_id
     * @return array
     */
    public function GetOrderService($order_id, $hotel_id)
    {
        global $xoopsDB;
        $sql = "SELECT os.*,s.*,st.*,hs.service_extra_price FROM {$xoopsDB->prefix("martin_hotel_service")} s ";
        $sql .= "INNER JOIN {$xoopsDB->prefix("martin_order_service")} os ON (os.service_id = s.service_id) ";
        $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_type")} st ON (st.service_type_id = s.service_type_id) ";
        $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_relation")} hs ON (s.service_id = hs.service_id) ";
        $sql .= "WHERE os.order_id = $order_id AND hs.hotel_id = $hotel_id ";
        $sql .= "GROUP BY s.service_id";

        return $this->GetRows($sql, 'service_id');
    }
}


Issues (663)

Security Analysis not enabled

class/member.php (7 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

1		<?php
2
3		/**
4		* @处理用户中心
5		* @license http://www.blags.org/
6		* @created :2010年07月14日 21时54分
7		* @copyright 1997-2010 The Martin Group
8		* @author Martin <[email protected]>
9		* */
10		class MartinMember extends XoopsObject
11		{
12		}
13
14		/**
15		* @处理用户中心
16		* @method:
17		* @license http://www.blags.org/
18		* @created :2010年07月14日 21时54分
19		* @copyright 1997-2010 The Martin Group
20		* @author Martin <[email protected]>
21		* */
22		class MartinMemberHandler extends XoopsObjectHandler
23		{
24		/**
25		* @create cart object
26		* @license http://www.blags.org/
27		* @created :2010年07月04日 12时59分
28		* @copyright 1997-2010 The Martin Group
29		* @author Martin <[email protected]>
30		* */
31		public function &create()
32		{
33		$obj =& new MartinMember;
34
35		return $obj;
36		}
37
38		/**
39		* @get rows
40		* @license http://www.blags.org/
41		* @created :2010年06月20日 13时09分
42		* @copyright 1997-2010 The Martin Group
43		* @author Martin <[email protected]>
44		* @param $sql
45		* @param null $key
46		* @return array
47		*/
48	View Code Duplication	public function GetRows($sql, $key = null)
		0 ignored issues – show Duplication introduced 2019-01-19 05:03 UTC by Report Bug Copy Issue Report Show Similar Issues like this This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
49		{
50		global $xoopsDB;
51		$result = $xoopsDB->query($sql);
52		$rows = array();
53		while ($row = $xoopsDB->fetchArray($result)) {
54		if (is_null($key)) {
55		$rows[] = $row;
56		} else {
57		$rows[$row[$key]] = $row;
58		}
59		}
60
61		return $rows;
62		}
63
64		/**
65		* @add memeber favorite hotel
66		* @method:
67		* @license http://www.blags.org/
68		* @created :2010年07月18日 12时16分
69		* @copyright 1997-2010 The Martin Group
70		* @author Martin <[email protected]>
71		* @param $uid
72		* @param $hotel_id
73		* @return
74		*/
75		public function AddFavorite($uid, $hotel_id)
		0 ignored issues – show Documentation introduced 2019-01-19 05:03 UTC by Report Bug Copy Issue Report Show Similar Issues like this The return type could not be reliably inferred; please add a `@return` annotation. Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a `@return` annotation as described here. Loading history...
76		{
77		$sql = "INSERT INTO {$this->db->prefix("martin_user_favorite")} (uid,hotel_id) VALUES ($uid,$hotel_id)";
78
79		return $this->db->query($sql);
80		}
81
82		/**
83		* @
84		* @method:
85		* @license http://www.blags.org/
86		* @created :2010年07月18日 12时16分
87		* @copyright 1997-2010 The Martin Group
88		* @author Martin <[email protected]>
89		* @param $start
90		* @param bool $isLived
91		* @return array
92		*/
93		public function GetHotelList($start, $isLived = false)
94		{
95		$rows = array();
96		global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler;
97		$uid = $xoopsUser->uid();
98		if ($isLived) {
99		$order_table = $xoopsDB->prefix('martin_order');
100		$sql_str = "SELECT r.hotel_id FROM {$xoopsDB->prefix("martin_room")} r WHERE r.room_id IN
101		(
102		SELECT oqr.room_id FROM {$xoopsDB->prefix("martin_order_query_room")} oqr
103		WHERE order_id IN
104		(SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14)
105		UNION
106		SELECT mor.room_id FROM {$xoopsDB->prefix("martin_order_room")} mor
107		WHERE order_id IN
108		(SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14)
109		)";
110		} else {
111		$sql_str = "SELECT f.hotel_id FROM {$xoopsDB->prefix("martin_user_favorite")} f WHERE f.uid = $uid";
112		}
113
114		//总数
115		$sql_count = str_replace("r.hotel_id", "count(*) as count", $sql_str);
116		$sql_count = str_replace("f.hotel_id", "count(*) as count", $sql_count);
117		list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count));
118
119		$sql = "SELECT h.hotel_id,h.hotel_alias,h.hotel_city,h.hotel_name,h.hotel_city_id
120		FROM {$xoopsDB->prefix("martin_hotel")} h WHERE h.hotel_id IN (%s) ";
121		$sql .= "GROUP BY hotel_id ORDER BY h.hotel_rank ASC ";
122		$sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}";
123		$sql = sprintf($sql, $sql_str);
124		//echo $sql;
125		$hotels = $this->GetRows($sql, 'hotel_id');
126		$hotelAlias = $search_handler->GetCityAlias();
127		$cityList = $hotel_handler->getCityList();
128		if (is_array($hotels)) {
129		foreach ($hotels as $key => $value) {
130		$city_ids = explode(",", $value['hotel_city_id']);
131		foreach ($city_ids as $id) {
132		$city_name[] = $cityList[$id];
		0 ignored issues – show Coding Style Comprehensibility introduced 2015-12-30 18:20 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$city_name` was never initialized. Although not strictly required by PHP, it is generally a good practice to add `$city_name = array();` before regardless. Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) { $myArray['foo'] = $item->getFoo(); if ($item->hasBar()) { $myArray['bar'] = $item->getBar(); } // do something with $myArray } As you can see in this example, the array `$myArray` is initialized the first time when the foreach loop is entered. You can also see that the value of the `bar` key is only written conditionally; thus, its value might result from a previous iteration. This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization `$myArray = array()` either outside or inside the foreach loop. Loading history...
133		}
134		$value['hotel_city_id'] = implode("、", $city_name);
		0 ignored issues – show Bug introduced 2015-12-30 18:20 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$city_name` does not seem to be defined for all execution paths leading up to this point. If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) { switch ($a) { case 'foo': $x = 1; break; case 'bar': $x = 2; break; } // $x is potentially undefined here. echo $x; } In the above example, the variable `$x` is defined if you pass “foo” or “bar” as argument for `$a`. However, since the `switch` statement has no default case statement, if you pass any other value, the variable `$x` would be undefined. Available Fixes Check for existence of the variable explicitly: function myFunction($a) { switch ($a) { case 'foo': $x = 1; break; case 'bar': $x = 2; break; } if (isset($x)) { // Make sure it's always set. echo $x; } } Define a default value for the variable: function myFunction($a) { $x = ''; // Set a default which gets overridden for certain paths. switch ($a) { case 'foo': $x = 1; break; case 'bar': $x = 2; break; } echo $x; } Add a value for the missing path: function myFunction($a) { switch ($a) { case 'foo': $x = 1; break; case 'bar': $x = 2; break; // We add support for the missing case. default: $x = ''; break; } echo $x; } Loading history...
135		$value['hotel_city_alias'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']];
136		$value['url'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']] . '/' . $value['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix'];
137		$value['hotel_city'] = $cityList[$value['hotel_city']];
138		$rows[] = $value;
139		unset($value, $city_name);
140		}
141		}
142		unset($hotelAlias, $cityList);
143
144		return $rows;
145		}
146
147		/**
148		* @
149		* @method:
150		* @license http://www.blags.org/
151		* @created :2010年07月18日 12时16分
152		* @copyright 1997-2010 The Martin Group
153		* @author Martin <[email protected]>
154		* @param $start
155		* @return array
156		*/
157		public function GetCouponList($start)
158		{
159		$rows = array();
		0 ignored issues – show Unused Code introduced 2015-12-30 18:20 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$rows` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
160		global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler;
161		$table = $xoopsDB->prefix("martin_user_coupon");
162		$uid = $xoopsUser->uid();
163		$sql = "SELECT count(*) as count FROM $table WHERE uid = $uid";
		0 ignored issues – show Unused Code introduced 2015-12-30 18:20 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$sql` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
164		list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count));
		0 ignored issues – show Bug introduced 2015-12-30 18:20 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$sql_count` does not exist. Did you forget to declare it? This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. Loading history...
165
166		$sql = "SELECT c.*,h.hotel_name FROM $table c
167		LEFT JOIN {$xoopsDB->prefix("martin_order")} o ON (c.relation_id = o.order_id)
168		LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (o.order_id = mor.order_id)
169		LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.room_id = mor.room_id)
170		LEFT JOIN {$xoopsDB->prefix("martin_hotel")} h ON (r.hotel_id = h.hotel_id)
171		";
172		$sql .= " WHERE o.order_uid = $uid AND c.coupon_type = 1 ";
173		$sql .= "UNION SELECT ob.*,'注册' FROM $table ob WHERE ob.coupon_type = 2 AND ob.uid = $uid ";
174		$sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}";
175		$rows = $this->GetRows($sql);
176
177		return $rows;
178		}
179
180		/**
181		* @get order hotels
182		* @method:
183		* @license http://www.blags.org/
184		* @created :2010年07月19日 20时40分
185		* @copyright 1997-2010 The Martin Group
186		* @author Martin <[email protected]>
187		* @param $order_ids
188		* @return array\|null
189		*/
190		public function getOrderHotels($order_ids)
191		{
192		global $xoopsDB;
193		if (empty($order_ids)) {
194		return null;
195		}
196		$sql = "SELECT h.hotel_name,h.hotel_alias,h.hotel_city,mor.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h ";
197		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) ";
198		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) ";
199		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (mor.room_id = r.room_id) ";
200		$sql .= "WHERE mor.order_id IN (" . implode(",", $order_ids) . ") GROUP BY mor.order_id ";
201		$sql .= "UNION SELECT h.hotel_name,h.hotel_alias,h.hotel_city,oqr.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h ";
202		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) ";
203		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) ";
204		$sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_query_room")} oqr ON (oqr.room_id = r.room_id) ";
205		$sql .= "WHERE oqr.order_id IN (" . implode(",", $order_ids) . ") GROUP BY oqr.order_id ";
206
207		return $this->GetRows($sql, 'order_id');
208		}
209
210		/**
211		* @
212		* @method:
213		* @license http://www.blags.org/
214		* @created :2010年07月19日 20时40分
215		* @copyright 1997-2010 The Martin Group
216		* @author Martin <[email protected]>
217		* @param $order_id
218		* @param $hotel_id
219		* @return array
220		*/
221		public function GetOrderService($order_id, $hotel_id)
222		{
223		global $xoopsDB;
224		$sql = "SELECT os.,s.,st.*,hs.service_extra_price FROM {$xoopsDB->prefix("martin_hotel_service")} s ";
225		$sql .= "INNER JOIN {$xoopsDB->prefix("martin_order_service")} os ON (os.service_id = s.service_id) ";
226		$sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_type")} st ON (st.service_type_id = s.service_type_id) ";
227		$sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_relation")} hs ON (s.service_id = hs.service_id) ";
228		$sql .= "WHERE os.order_id = $order_id AND hs.hotel_id = $hotel_id ";
229		$sql .= "GROUP BY s.service_id";
230
231		return $this->GetRows($sql, 'service_id');
232		}
233		}
234

mambax7 / xoops-martin

Issues (663)

Security Analysis not enabled

class/member.php (7 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Duplication Side-by-Side

Filter issues like