mbirth /
cops
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * COPS (Calibre OPDS PHP Server) class file |
||
| 4 | * |
||
| 5 | * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) |
||
| 6 | * @author Sébastien Lucas <[email protected]> |
||
| 7 | */ |
||
| 8 | |||
| 9 | class CustomColumnTypeText extends CustomColumnType |
||
|
0 ignored issues
–
show
|
|||
| 10 | { |
||
| 11 | 5 | protected function __construct($pcustomId) |
|
| 12 | { |
||
| 13 | 5 | parent::__construct($pcustomId, self::CUSTOM_TYPE_TEXT); |
|
| 14 | 5 | } |
|
| 15 | |||
| 16 | /** |
||
| 17 | * Get the name of the sqlite table for this column |
||
| 18 | * |
||
| 19 | * @return string|null |
||
| 20 | */ |
||
| 21 | 11 | private function getTableName() |
|
| 22 | { |
||
| 23 | 11 | return "custom_column_{$this->customId}"; |
|
|
0 ignored issues
–
show
As per coding-style, please use concatenation or
sprintf for the variable $this instead of interpolation.
It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings. // Instead of
$x = "foo $bar $baz";
// Better use either
$x = "foo " . $bar . " " . $baz;
$x = sprintf("foo %s %s", $bar, $baz);
Loading history...
|
|||
| 24 | } |
||
| 25 | |||
| 26 | /** |
||
| 27 | * Get the name of the linking sqlite table for this column |
||
| 28 | * (or NULL if there is no linktable) |
||
| 29 | * |
||
| 30 | * @return string|null |
||
| 31 | */ |
||
| 32 | 11 | private function getTableLinkName() |
|
| 33 | { |
||
| 34 | 11 | return "books_custom_column_{$this->customId}_link"; |
|
|
0 ignored issues
–
show
As per coding-style, please use concatenation or
sprintf for the variable $this instead of interpolation.
It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings. // Instead of
$x = "foo $bar $baz";
// Better use either
$x = "foo " . $bar . " " . $baz;
$x = sprintf("foo %s %s", $bar, $baz);
Loading history...
|
|||
| 35 | } |
||
| 36 | |||
| 37 | /** |
||
| 38 | * Get the name of the linking column in the linktable |
||
| 39 | * |
||
| 40 | * @return string|null |
||
| 41 | */ |
||
| 42 | 11 | private function getTableLinkColumn() |
|
| 43 | { |
||
| 44 | 11 | return "value"; |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
value does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 45 | } |
||
| 46 | |||
| 47 | 4 | public function getQuery($id) |
|
| 48 | { |
||
| 49 | 4 | $query = str_format(Book::SQL_BOOKS_BY_CUSTOM, "{0}", "{1}", $this->getTableLinkName(), $this->getTableLinkColumn()); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
{0} does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
Coding Style
Comprehensibility
introduced
by
The string literal
{1} does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 50 | 4 | return array($query, array($id)); |
|
| 51 | } |
||
| 52 | |||
| 53 | 4 | public function getCustom($id) |
|
| 54 | { |
||
| 55 | 4 | $result = Base::getDb()->prepare(str_format("SELECT id, value AS name FROM {0} WHERE id = ?", $this->getTableName())); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
SELECT id, value AS name FROM {0} WHERE id = ? does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 56 | 4 | $result->execute(array($id)); |
|
| 57 | 4 | if ($post = $result->fetchObject()) { |
|
| 58 | 4 | return new CustomColumn($id, $post->name, $this); |
|
| 59 | } |
||
| 60 | return NULL; |
||
| 61 | } |
||
| 62 | |||
| 63 | 5 | View Code Duplication | protected function getAllCustomValuesFromDatabase() |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 64 | { |
||
| 65 | 5 | $queryFormat = "SELECT {0}.id AS id, {0}.value AS name, count(*) AS count FROM {0}, {1} WHERE {0}.id = {1}.{2} GROUP BY {0}.id, {0}.value ORDER BY {0}.value"; |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
SELECT {0}.id AS id, {0}...alue ORDER BY {0}.value does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 66 | 5 | $query = str_format($queryFormat, $this->getTableName(), $this->getTableLinkName(), $this->getTableLinkColumn()); |
|
| 67 | |||
| 68 | 5 | $result = Base::getDb()->query($query); |
|
| 69 | 5 | $entryArray = array(); |
|
| 70 | 5 | while ($post = $result->fetchObject()) |
|
| 71 | { |
||
| 72 | 5 | $entryPContent = str_format(localize("bookword", $post->count), $post->count); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
bookword does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 73 | 5 | $entryPLinkArray = array(new LinkNavigation ($this->getUri($post->id))); |
|
| 74 | |||
| 75 | 5 | $entry = new Entry($post->name, $this->getEntryId($post->id), $entryPContent, $this->datatype, $entryPLinkArray, "", $post->count); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 76 | |||
| 77 | 5 | array_push($entryArray, $entry); |
|
| 78 | 5 | } |
|
| 79 | 5 | return $entryArray; |
|
| 80 | } |
||
| 81 | |||
| 82 | 9 | public function getDescription() |
|
| 83 | { |
||
| 84 | 9 | $desc = $this->getDatabaseDescription(); |
|
| 85 | 9 | if ($desc === NULL || empty($desc)) $desc = str_format(localize("customcolumn.description"), $this->getTitle()); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
customcolumn.description does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 86 | 9 | return $desc; |
|
| 87 | } |
||
| 88 | |||
| 89 | 2 | View Code Duplication | public function getCustomByBook($book) |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 90 | { |
||
| 91 | 2 | $queryFormat = "SELECT {0}.id AS id, {0}.{2} AS name FROM {0}, {1} WHERE {0}.id = {1}.{2} AND {1}.book = {3} ORDER BY {0}.value"; |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
SELECT {0}.id AS id, {0}... {3} ORDER BY {0}.value does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 92 | 2 | $query = str_format($queryFormat, $this->getTableName(), $this->getTableLinkName(), $this->getTableLinkColumn(), $book->id); |
|
| 93 | |||
| 94 | 2 | $result = Base::getDb()->query($query); |
|
| 95 | 2 | if ($post = $result->fetchObject()) { |
|
| 96 | 2 | return new CustomColumn($post->id, $post->name, $this); |
|
| 97 | } |
||
| 98 | return new CustomColumn(NULL, "", $this); |
||
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 99 | } |
||
| 100 | |||
| 101 | 9 | public function isSearchable() |
|
| 102 | { |
||
| 103 | 9 | return true; |
|
| 104 | } |
||
| 105 | } |
||
| 106 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.