This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @hotel search object |
||
4 | * @license http://www.blags.org/ |
||
5 | * @created :2010年06月27日 14时08分 |
||
6 | * @copyright 1997-2010 The Martin Group |
||
7 | * @author Martin <[email protected]> |
||
8 | * */ |
||
9 | if (!defined("XOOPS_ROOT_PATH")) { |
||
10 | die("XOOPS root path not defined"); |
||
11 | } |
||
12 | |||
13 | /** |
||
14 | * Class MartinSearch |
||
15 | */ |
||
16 | class MartinSearch extends XoopsObject |
||
17 | { |
||
18 | public function MartinSearch() |
||
19 | { |
||
20 | /*$this->initVar("city_id", XOBJ_DTYPE_INT, null, false); |
||
21 | $this->initVar("hotel_star", XOBJ_DTYPE_TXTBOX, null, true, 255); |
||
22 | $this->initVar("hotel_name", XOBJ_DTYPE_TXTBOX, null, false, 255);*/ |
||
23 | } |
||
24 | } |
||
25 | |||
26 | /** |
||
27 | * Class MartinSearchHandler |
||
28 | */ |
||
29 | class MartinSearchHandler extends XoopsObjectHandler |
||
30 | { |
||
31 | /** |
||
32 | * @return MartinSearch |
||
33 | */ |
||
34 | public function create() |
||
35 | { |
||
36 | return new MartinSearch(); |
||
37 | } |
||
38 | |||
39 | /** |
||
40 | * @get rows |
||
41 | * @license http://www.blags.org/ |
||
42 | * @created :2010年06月20日 13时09分 |
||
43 | * @copyright 1997-2010 The Martin Group |
||
44 | * @author Martin <[email protected]> |
||
45 | * @param $sql |
||
46 | * @param null $key |
||
47 | * @return array |
||
48 | */ |
||
49 | View Code Duplication | public function GetRows($sql, $key = null) |
|
50 | { |
||
51 | global $xoopsDB; |
||
52 | $result = $xoopsDB->query($sql); |
||
53 | $rows = array(); |
||
54 | while ($row = $xoopsDB->fetchArray($result)) { |
||
55 | if (is_null($key)) { |
||
56 | $rows[] = $row; |
||
57 | } else { |
||
58 | $rows[$row[$key]] = $row; |
||
59 | } |
||
60 | } |
||
61 | |||
62 | return $rows; |
||
63 | } |
||
64 | |||
65 | /** |
||
66 | * @search hotels |
||
67 | * @license http://www.blags.org/ |
||
68 | * @created :2010年06月27日 19时57分 |
||
69 | * @copyright 1997-2010 The Martin Group |
||
70 | * @author Martin <[email protected]> |
||
71 | * @param $Data |
||
72 | * @return array |
||
73 | */ |
||
74 | public function Search($Data) |
||
75 | { |
||
76 | global $hotel_handler, $xoopsModuleConfig; |
||
77 | //var_dump($xoopsModuleConfig); |
||
78 | |||
79 | $rows = array(); |
||
80 | $dateTime = strtotime(date('Y-m-d')); |
||
0 ignored issues
–
show
|
|||
81 | foreach ($Data as $key => $value) { |
||
82 | ${$key} = $value; |
||
83 | } |
||
84 | $city_ids = $this->GetCityIds($hotel_address); |
||
0 ignored issues
–
show
The variable
$hotel_address does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() |
|||
85 | //var_dump($Data); |
||
86 | $sql = "SELECT h.*,hc.city_name as hotel_city FROM " . $this->db->prefix("martin_hotel") . " h "; |
||
87 | $sql .= "INNER JOIN " . $this->db->prefix("martin_room") . " r ON (h.hotel_id = r.hotel_id) "; |
||
88 | $sql .= "INNER JOIN " . $this->db->prefix("martin_room_price") . " rp ON (r.room_id = rp.room_id) "; |
||
89 | $sql .= "INNER JOIN " . $this->db->prefix("martin_hotel_city") . " hc ON (h.hotel_city = hc.city_id) "; |
||
90 | $sql .= " WHERE 1 = 1 "; |
||
91 | $sql .= (empty($hotel_address) || empty($hotel_ids)) ? "" : $city_ids . " IN h.hotel_city_id "; |
||
0 ignored issues
–
show
The variable
$hotel_ids seems only to be defined at a later point. As such the call to empty() seems to always evaluate to true .
This check marks calls to This is likely the result of code being shifted around. Consider removing these calls. ![]() |
|||
92 | $sql .= empty($hotel_name) ? "" : "AND h.hotel_name LIKE '%$hotel_name%' "; |
||
0 ignored issues
–
show
The variable
$hotel_name seems to never exist, and therefore empty should always return true . Did you maybe rename this variable?
This check looks for calls to This is most likely caused by the renaming of a variable or the removal of a function/method parameter. ![]() |
|||
93 | $sql .= $city_id > 0 ? "AND h.hotel_city IN (SELECT city_id FROM " . $this->db->prefix("martin_hotel_city") . " WHERE city_parentid = $city_id ) " : ""; |
||
94 | $sql .= $hotel_star > 0 ? "AND h.hotel_star = $hotel_star " : ""; |
||
0 ignored issues
–
show
|
|||
95 | $sql .= (is_array($price) && $price[0] > 0 && $price[1] > 0) ? "AND rp.room_price >= {$price[0]} AND rp.room_price <= {$price[1]} " : ""; |
||
0 ignored issues
–
show
|
|||
96 | $sql .= (is_array($check_date) && $check_date[0] > 0 && $check_date[1] > 0) ? "AND rp.room_date >= {$check_date[0]} AND rp.room_date <= {$check_date[1]} " : ""; |
||
0 ignored issues
–
show
|
|||
97 | $sql .= "GROUP BY h.hotel_id "; |
||
98 | $sql .= (empty($order) || empty($by)) ? " ORDER BY h.hotel_rank DESC , h.hotel_id DESC " : " ORDER BY $order $by ,h.hotel_rank DESC "; |
||
0 ignored issues
–
show
The variable
$order seems to never exist, and therefore empty should always return true . Did you maybe rename this variable?
This check looks for calls to This is most likely caused by the renaming of a variable or the removal of a function/method parameter. ![]() The variable
$by seems to never exist, and therefore empty should always return true . Did you maybe rename this variable?
This check looks for calls to This is most likely caused by the renaming of a variable or the removal of a function/method parameter. ![]() |
|||
99 | $rows['count'] = $this->GetCount(str_replace("h.*", "count(h.hotel_id) as count", $sql)); |
||
100 | $sql .= "LIMIT $start,{$xoopsModuleConfig['perpage']}"; |
||
0 ignored issues
–
show
|
|||
101 | //echo $sql; |
||
102 | |||
103 | $result = $this->db->query($sql); |
||
104 | $this->hotel_ids = &$hotel_ids; |
||
0 ignored issues
–
show
The variable
$hotel_ids does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
105 | $cityList = &$hotel_handler->getCityList(); |
||
106 | View Code Duplication | while ($row = $this->db->fetchArray($result)) { |
|
107 | $hotel_ids[] = $row['hotel_id']; |
||
108 | $city_ids = explode(',', $row['hotel_city_id']); |
||
109 | foreach ($city_ids as $id) { |
||
110 | $city_name[] = $cityList[$id]; |
||
111 | } |
||
112 | $row['city_name'] = implode('、', $city_name); |
||
0 ignored issues
–
show
The variable
$city_name does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
113 | $row['hotel_image'] = unserialize($row['hotel_image']); |
||
114 | $row['hotel_google'] = unserialize(unserialize($row['hotel_google'])); |
||
115 | //var_dump($row['hotel_google']); |
||
116 | $rows[] = $row; |
||
117 | unset($city_name); |
||
118 | } |
||
119 | |||
120 | //$rows = $this->GetRows($sql,'hotel_id'); |
||
121 | return $rows; |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * @get search count |
||
126 | * @license http://www.blags.org/ |
||
127 | * @created :2010年06月27日 19时57分 |
||
128 | * @copyright 1997-2010 The Martin Group |
||
129 | * @author Martin <[email protected]> |
||
130 | * @param $sql |
||
131 | * @return int |
||
132 | */ |
||
133 | public function GetCount($sql) |
||
134 | { |
||
135 | if (empty($sql)) { |
||
136 | return $sql; |
||
137 | } |
||
138 | $count = 0; |
||
139 | $result = $this->db->query($sql); |
||
140 | while ($this->db->fetchArray($result)) { |
||
141 | $count++; |
||
142 | } |
||
143 | |||
144 | return $count; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * @get city ids |
||
149 | * @license http://www.blags.org/ |
||
150 | * @created :2010年06月27日 14时08分 |
||
151 | * @copyright 1997-2010 The Martin Group |
||
152 | * @author Martin <[email protected]> |
||
153 | * @param $city_name |
||
154 | * @return null|string |
||
155 | */ |
||
156 | public function GetCityIds($city_name) |
||
157 | { |
||
158 | global $xoopsDB; |
||
159 | $sql = "SELECT city_id FROM " . $xoopsDB->prefix("martin_hotel_city") . " WHERE city_name LIKE '%$city_name%'"; |
||
160 | $result = $xoopsDB->query($sql); |
||
161 | while ($city_id = $xoopsDB->fetchArray($result)) { |
||
162 | $city_ids[] = $city_id['city_id']; |
||
163 | } |
||
164 | |||
165 | return is_array($city_ids) ? implode(',', $city_ids) : null; |
||
0 ignored issues
–
show
The variable
$city_ids does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
166 | } |
||
167 | |||
168 | /** |
||
169 | * get hotel rooms |
||
170 | * @access public |
||
171 | * @param $room_date |
||
172 | * @copyright 1997-2010 The Martin Group |
||
173 | * @author Martin <[email protected]> |
||
174 | * @created time :2010-06-25 15:27:34 |
||
175 | */ |
||
176 | public function GethotelRooms($room_date) |
||
177 | { |
||
178 | if (empty($this->hotel_ids)) { |
||
179 | return $this->hotel_ids; |
||
180 | } |
||
181 | $sql = "SELECT r.*,rt.room_type_info,rp.room_is_today_special,rp.room_date, |
||
182 | GROUP_CONCAT(room_price) as room_prices,GROUP_CONCAT(room_date) as room_dates, |
||
183 | round(avg(rp.room_price),2) as room_price,round(avg(rp.room_advisory_range_small),2) as room_advisory_range_small, |
||
184 | round(avg(rp.room_advisory_range_max),2) as room_advisory_range_max,round(avg(rp.room_sented_coupon),2) as room_sented_coupon |
||
185 | FROM " . $this->db->prefix("martin_room") . " r INNER JOIN " . $this->db->prefix("martin_room_type") . " rt ON (r.room_type_id = rt.room_type_id) |
||
186 | INNER JOIN " . $this->db->prefix("martin_room_price") . " rp ON (rp.room_id = r.room_id) |
||
187 | WHERE r.hotel_id IN (" . implode(",", $this->hotel_ids) . ") "; |
||
188 | $sql .= ($room_date[0] > 0 && $room_date[1] > 0) ? "AND rp.room_date >= {$room_date[0]} AND rp.room_price <= {$room_date[1]} " : " "; |
||
189 | $sql .= "GROUP BY r.room_id"; |
||
190 | $rows = array(); |
||
191 | $result = $this->db->query($sql); |
||
192 | while ($row = $this->db->fetchArray($result)) { |
||
193 | $room_dates = array(); |
||
0 ignored issues
–
show
$room_dates is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
194 | $row['room_prices'] = explode(",", $row['room_prices']); |
||
195 | $row['room_dates'] = explode(",", $row['room_dates']); |
||
196 | foreach ($row['room_prices'] as $key => $room_price) { |
||
197 | $d = $row['room_dates'][$key]; |
||
198 | if ($d >= $room_date[0] && $d < $room_date[1]) { |
||
199 | $room_prices[] = array('date' => date('Y-m-d', $d), 'price' => $room_price); |
||
200 | } |
||
201 | } |
||
202 | unset($row['room_prices'], $row['room_dates']); |
||
203 | $row['room_prices'] = $room_prices; |
||
0 ignored issues
–
show
The variable
$room_prices does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
204 | $row['room_date'] = date('Y-m-d', $row['room_date']); |
||
205 | $rows[$row['hotel_id']][] = $row; |
||
206 | unset($row, $room_prices); |
||
207 | } |
||
208 | |||
209 | return $rows; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * @get city name |
||
214 | * @method: |
||
215 | * @license http://www.blags.org/ |
||
216 | * @created :2010年06月27日 19时57分 |
||
217 | * @copyright 1997-2010 The Martin Group |
||
218 | * @author Martin <[email protected]> |
||
219 | * @param $city_id |
||
220 | * @return null |
||
221 | */ |
||
222 | public function GetCityName($city_id) |
||
223 | { |
||
224 | if (empty($city_id)) { |
||
225 | return $city_id; |
||
226 | } |
||
227 | $sql = "SELECT city_name FROM " . $this->db->prefix("martin_hotel_city") . " WHERE city_id = $city_id"; |
||
228 | $row = $this->db->fetchRow($this->db->query($sql)); |
||
229 | |||
230 | return isset($row[0]) ? $row[0] : null; |
||
231 | } |
||
232 | } |
||
233 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.