This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @hotel search object |
||
4 | * @license http://www.blags.org/ |
||
5 | * @created :2010年06月27日 14时08分 |
||
6 | * @copyright 1997-2010 The Martin Group |
||
7 | * @author Martin <[email protected]> |
||
8 | * */ |
||
9 | if (!defined("XOOPS_ROOT_PATH")) { |
||
10 | die("XOOPS root path not defined"); |
||
11 | } |
||
12 | |||
13 | /** |
||
14 | * Class MartinSearch |
||
15 | */ |
||
16 | class MartinSearch extends XoopsObject |
||
17 | { |
||
18 | public function MartinSearch() |
||
19 | { |
||
20 | /*$this->initVar("city_id", XOBJ_DTYPE_INT, null, false); |
||
21 | $this->initVar("hotel_star", XOBJ_DTYPE_TXTBOX, null, true, 255); |
||
22 | $this->initVar("hotel_name", XOBJ_DTYPE_TXTBOX, null, false, 255);*/ |
||
23 | } |
||
24 | } |
||
25 | |||
26 | /** |
||
27 | * Class MartinSearchHandler |
||
28 | */ |
||
29 | class MartinSearchHandler extends XoopsObjectHandler |
||
30 | { |
||
31 | /** |
||
32 | * @return MartinSearch |
||
33 | */ |
||
34 | public function create() |
||
35 | { |
||
36 | return new MartinSearch(); |
||
37 | } |
||
38 | |||
39 | /** |
||
40 | * @get rows |
||
41 | * @license http://www.blags.org/ |
||
42 | * @created :2010年06月20日 13时09分 |
||
43 | * @copyright 1997-2010 The Martin Group |
||
44 | * @author Martin <[email protected]> |
||
45 | * @param $sql |
||
46 | * @param null $key |
||
47 | * @return array |
||
48 | */ |
||
49 | View Code Duplication | public function GetRows($sql, $key = null) |
|
50 | { |
||
51 | global $xoopsDB; |
||
52 | $result = $xoopsDB->query($sql); |
||
53 | $rows = array(); |
||
54 | while ($row = $xoopsDB->fetchArray($result)) { |
||
55 | if (is_null($key)) { |
||
56 | $rows[] = $row; |
||
57 | } else { |
||
58 | $rows[$row[$key]] = $row; |
||
59 | } |
||
60 | } |
||
61 | |||
62 | return $rows; |
||
63 | } |
||
64 | |||
65 | /** |
||
66 | * @search hotels |
||
67 | * @license http://www.blags.org/ |
||
68 | * @created :2010年06月27日 19时57分 |
||
69 | * @copyright 1997-2010 The Martin Group |
||
70 | * @author Martin <[email protected]> |
||
71 | * @param $Data |
||
72 | * @return array |
||
73 | */ |
||
74 | public function Search($Data) |
||
75 | { |
||
76 | global $hotel_handler, $xoopsModuleConfig; |
||
77 | //var_dump($xoopsModuleConfig); |
||
78 | |||
79 | $rows = array(); |
||
80 | $dateTime = strtotime(date('Y-m-d')); |
||
81 | foreach ($Data as $key => $value) { |
||
82 | ${$key} = $value; |
||
83 | } |
||
84 | $city_ids = $this->GetCityIds($hotel_address); |
||
85 | //var_dump($Data); |
||
86 | $sql = "SELECT h.*,hc.city_name as hotel_city FROM " . $this->db->prefix("martin_hotel") . " h "; |
||
87 | $sql .= "INNER JOIN " . $this->db->prefix("martin_room") . " r ON (h.hotel_id = r.hotel_id) "; |
||
88 | $sql .= "INNER JOIN " . $this->db->prefix("martin_room_price") . " rp ON (r.room_id = rp.room_id) "; |
||
89 | $sql .= "INNER JOIN " . $this->db->prefix("martin_hotel_city") . " hc ON (h.hotel_city = hc.city_id) "; |
||
90 | $sql .= " WHERE 1 = 1 "; |
||
91 | $sql .= (empty($hotel_address) || empty($hotel_ids)) ? "" : $city_ids . " IN h.hotel_city_id "; |
||
92 | $sql .= empty($hotel_name) ? "" : "AND h.hotel_name LIKE '%$hotel_name%' "; |
||
93 | $sql .= $city_id > 0 ? "AND h.hotel_city IN (SELECT city_id FROM " . $this->db->prefix("martin_hotel_city") . " WHERE city_parentid = $city_id ) " : ""; |
||
94 | $sql .= $hotel_star > 0 ? "AND h.hotel_star = $hotel_star " : ""; |
||
95 | $sql .= (is_array($price) && $price[0] > 0 && $price[1] > 0) ? "AND rp.room_price >= {$price[0]} AND rp.room_price <= {$price[1]} " : ""; |
||
96 | $sql .= (is_array($check_date) && $check_date[0] > 0 && $check_date[1] > 0) ? "AND rp.room_date >= {$check_date[0]} AND rp.room_date <= {$check_date[1]} " : ""; |
||
97 | $sql .= "GROUP BY h.hotel_id "; |
||
98 | $sql .= (empty($order) || empty($by)) ? " ORDER BY h.hotel_rank DESC , h.hotel_id DESC " : " ORDER BY $order $by ,h.hotel_rank DESC "; |
||
99 | $rows['count'] = $this->GetCount(str_replace("h.*", "count(h.hotel_id) as count", $sql)); |
||
100 | $sql .= "LIMIT $start,{$xoopsModuleConfig['perpage']}"; |
||
101 | //echo $sql; |
||
102 | |||
103 | $result = $this->db->query($sql); |
||
104 | $this->hotel_ids = &$hotel_ids; |
||
105 | $cityList = &$hotel_handler->getCityList(); |
||
106 | View Code Duplication | while ($row = $this->db->fetchArray($result)) { |
|
107 | $hotel_ids[] = $row['hotel_id']; |
||
108 | $city_ids = explode(',', $row['hotel_city_id']); |
||
109 | foreach ($city_ids as $id) { |
||
110 | $city_name[] = $cityList[$id]; |
||
0 ignored issues
–
show
|
|||
111 | } |
||
112 | $row['city_name'] = implode('、', $city_name); |
||
113 | $row['hotel_image'] = unserialize($row['hotel_image']); |
||
114 | $row['hotel_google'] = unserialize(unserialize($row['hotel_google'])); |
||
115 | //var_dump($row['hotel_google']); |
||
116 | $rows[] = $row; |
||
117 | unset($city_name); |
||
118 | } |
||
119 | |||
120 | //$rows = $this->GetRows($sql,'hotel_id'); |
||
121 | return $rows; |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * @get search count |
||
126 | * @license http://www.blags.org/ |
||
127 | * @created :2010年06月27日 19时57分 |
||
128 | * @copyright 1997-2010 The Martin Group |
||
129 | * @author Martin <[email protected]> |
||
130 | * @param $sql |
||
131 | * @return int |
||
132 | */ |
||
133 | public function GetCount($sql) |
||
134 | { |
||
135 | if (empty($sql)) { |
||
136 | return $sql; |
||
137 | } |
||
138 | $count = 0; |
||
139 | $result = $this->db->query($sql); |
||
140 | while ($this->db->fetchArray($result)) { |
||
141 | $count++; |
||
142 | } |
||
143 | |||
144 | return $count; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * @get city ids |
||
149 | * @license http://www.blags.org/ |
||
150 | * @created :2010年06月27日 14时08分 |
||
151 | * @copyright 1997-2010 The Martin Group |
||
152 | * @author Martin <[email protected]> |
||
153 | * @param $city_name |
||
154 | * @return null|string |
||
155 | */ |
||
156 | public function GetCityIds($city_name) |
||
157 | { |
||
158 | global $xoopsDB; |
||
159 | $sql = "SELECT city_id FROM " . $xoopsDB->prefix("martin_hotel_city") . " WHERE city_name LIKE '%$city_name%'"; |
||
160 | $result = $xoopsDB->query($sql); |
||
161 | while ($city_id = $xoopsDB->fetchArray($result)) { |
||
162 | $city_ids[] = $city_id['city_id']; |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$city_ids was never initialized. Although not strictly required by PHP, it is generally a good practice to add $city_ids = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
163 | } |
||
164 | |||
165 | return is_array($city_ids) ? implode(',', $city_ids) : null; |
||
166 | } |
||
167 | |||
168 | /** |
||
169 | * get hotel rooms |
||
170 | * @access public |
||
171 | * @param $room_date |
||
172 | * @copyright 1997-2010 The Martin Group |
||
173 | * @author Martin <[email protected]> |
||
174 | * @created time :2010-06-25 15:27:34 |
||
175 | */ |
||
176 | public function GethotelRooms($room_date) |
||
177 | { |
||
178 | if (empty($this->hotel_ids)) { |
||
179 | return $this->hotel_ids; |
||
180 | } |
||
181 | $sql = "SELECT r.*,rt.room_type_info,rp.room_is_today_special,rp.room_date, |
||
182 | GROUP_CONCAT(room_price) as room_prices,GROUP_CONCAT(room_date) as room_dates, |
||
183 | round(avg(rp.room_price),2) as room_price,round(avg(rp.room_advisory_range_small),2) as room_advisory_range_small, |
||
184 | round(avg(rp.room_advisory_range_max),2) as room_advisory_range_max,round(avg(rp.room_sented_coupon),2) as room_sented_coupon |
||
185 | FROM " . $this->db->prefix("martin_room") . " r INNER JOIN " . $this->db->prefix("martin_room_type") . " rt ON (r.room_type_id = rt.room_type_id) |
||
186 | INNER JOIN " . $this->db->prefix("martin_room_price") . " rp ON (rp.room_id = r.room_id) |
||
187 | WHERE r.hotel_id IN (" . implode(",", $this->hotel_ids) . ") "; |
||
188 | $sql .= ($room_date[0] > 0 && $room_date[1] > 0) ? "AND rp.room_date >= {$room_date[0]} AND rp.room_price <= {$room_date[1]} " : " "; |
||
189 | $sql .= "GROUP BY r.room_id"; |
||
190 | $rows = array(); |
||
191 | $result = $this->db->query($sql); |
||
192 | while ($row = $this->db->fetchArray($result)) { |
||
193 | $room_dates = array(); |
||
194 | $row['room_prices'] = explode(",", $row['room_prices']); |
||
195 | $row['room_dates'] = explode(",", $row['room_dates']); |
||
196 | foreach ($row['room_prices'] as $key => $room_price) { |
||
197 | $d = $row['room_dates'][$key]; |
||
198 | if ($d >= $room_date[0] && $d < $room_date[1]) { |
||
199 | $room_prices[] = array('date' => date('Y-m-d', $d), 'price' => $room_price); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$room_prices was never initialized. Although not strictly required by PHP, it is generally a good practice to add $room_prices = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
200 | } |
||
201 | } |
||
202 | unset($row['room_prices'], $row['room_dates']); |
||
203 | $row['room_prices'] = $room_prices; |
||
204 | $row['room_date'] = date('Y-m-d', $row['room_date']); |
||
205 | $rows[$row['hotel_id']][] = $row; |
||
206 | unset($row, $room_prices); |
||
207 | } |
||
208 | |||
209 | return $rows; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * @get city name |
||
214 | * @method: |
||
215 | * @license http://www.blags.org/ |
||
216 | * @created :2010年06月27日 19时57分 |
||
217 | * @copyright 1997-2010 The Martin Group |
||
218 | * @author Martin <[email protected]> |
||
219 | * @param $city_id |
||
220 | * @return null |
||
221 | */ |
||
222 | public function GetCityName($city_id) |
||
223 | { |
||
224 | if (empty($city_id)) { |
||
225 | return $city_id; |
||
226 | } |
||
227 | $sql = "SELECT city_name FROM " . $this->db->prefix("martin_hotel_city") . " WHERE city_id = $city_id"; |
||
228 | $row = $this->db->fetchRow($this->db->query($sql)); |
||
229 | |||
230 | return isset($row[0]) ? $row[0] : null; |
||
231 | } |
||
232 | } |
||
233 |
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.
Let’s take a look at an example:
As you can see in this example, the array
$myArray
is initialized the first time when the foreach loop is entered. You can also see that the value of thebar
key is only written conditionally; thus, its value might result from a previous iteration.This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.