mbirth /
cops
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * COPS (Calibre OPDS PHP Server) class file |
||
| 4 | * |
||
| 5 | * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) |
||
| 6 | * @author At Libitum <[email protected]> |
||
| 7 | */ |
||
| 8 | |||
| 9 | class Publisher |
||
|
0 ignored issues
–
show
|
|||
| 10 | { |
||
| 11 | const ALL_PUBLISHERS_ID = "cops:publishers"; |
||
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
cops:publishers does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 12 | const PUBLISHERS_COLUMNS = "publishers.id as id, publishers.name as name, count(*) as count"; |
||
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
publishers.id as id, pub...name, count(*) as count does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 13 | const SQL_ALL_PUBLISHERS = "select {0} from publishers, books_publishers_link where publishers.id = publisher group by publishers.id, publishers.name order by publishers.name"; |
||
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
select {0} from publishe...rder by publishers.name does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 14 | const SQL_PUBLISHERS_FOR_SEARCH = "select {0} from publishers, books_publishers_link where publishers.id = publisher and upper (publishers.name) like ? group by publishers.id, publishers.name order by publishers.name"; |
||
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
select {0} from publishe...rder by publishers.name does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 15 | |||
| 16 | |||
| 17 | public $id; |
||
| 18 | public $name; |
||
| 19 | |||
| 20 | 12 | public function __construct($post) { |
|
| 21 | 12 | $this->id = $post->id; |
|
| 22 | 12 | $this->name = $post->name; |
|
| 23 | 12 | } |
|
| 24 | |||
| 25 | 10 | public function getUri () { |
|
| 26 | 10 | return "?page=".Base::PAGE_PUBLISHER_DETAIL."&id=$this->id"; |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
?page= does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
As per coding-style, please use concatenation or
sprintf for the variable $this instead of interpolation.
It is generally a best practice as it is often more readable to use concatenation instead of interpolation for variables inside strings. // Instead of
$x = "foo $bar $baz";
// Better use either
$x = "foo " . $bar . " " . $baz;
$x = sprintf("foo %s %s", $bar, $baz);
Loading history...
|
|||
| 27 | } |
||
| 28 | |||
| 29 | 7 | public function getEntryId () { |
|
| 30 | 7 | return self::ALL_PUBLISHERS_ID.":".$this->id; |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
: does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 31 | } |
||
| 32 | |||
| 33 | 18 | public static function getCount() { |
|
| 34 | // str_format (localize("publishers.alphabetical", count(array)) |
||
|
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
50% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
|
|||
| 35 | 18 | return Base::getCountGeneric ("publishers", self::ALL_PUBLISHERS_ID, Base::PAGE_ALL_PUBLISHERS); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
publishers does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 36 | } |
||
| 37 | |||
| 38 | 5 | View Code Duplication | public static function getPublisherByBookId ($bookId) { |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 39 | 5 | $result = Base::getDb ()->prepare('select publishers.id as id, name |
|
| 40 | from books_publishers_link, publishers |
||
| 41 | 5 | where publishers.id = publisher and book = ?'); |
|
| 42 | 5 | $result->execute (array ($bookId)); |
|
| 43 | 5 | if ($post = $result->fetchObject ()) { |
|
| 44 | 5 | return new Publisher ($post); |
|
| 45 | } |
||
| 46 | return NULL; |
||
| 47 | } |
||
| 48 | |||
| 49 | 1 | View Code Duplication | public static function getPublisherById ($publisherId) { |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 50 | 1 | $result = Base::getDb ()->prepare('select id, name |
|
| 51 | 1 | from publishers where id = ?'); |
|
| 52 | 1 | $result->execute (array ($publisherId)); |
|
| 53 | 1 | if ($post = $result->fetchObject ()) { |
|
| 54 | 1 | return new Publisher ($post); |
|
| 55 | } |
||
| 56 | return NULL; |
||
| 57 | } |
||
| 58 | |||
| 59 | 2 | public static function getAllPublishers() { |
|
| 60 | 2 | return Base::getEntryArrayWithBookNumber (self::SQL_ALL_PUBLISHERS, self::PUBLISHERS_COLUMNS, array (), "Publisher"); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
Publisher does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 61 | } |
||
| 62 | |||
| 63 | 23 | public static function getAllPublishersByQuery($query) { |
|
| 64 | 23 | return Base::getEntryArrayWithBookNumber (self::SQL_PUBLISHERS_FOR_SEARCH, self::PUBLISHERS_COLUMNS, array ('%' . $query . '%'), "Publisher"); |
|
|
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
The string literal
Publisher does not require double quotes, as per coding-style, please use single quotes.
PHP provides two ways to mark string literals. Either with single quotes String literals in single quotes on the other hand are evaluated very literally and the only two
characters that needs escaping in the literal are the single quote itself ( Double quoted string literals may contain other variables or more complex escape sequences. <?php
$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";
print $doubleQuoted;
will print an indented: If your string literal does not contain variables or escape sequences, it should be defined using single quotes to make that fact clear. For more information on PHP string literals and available escape sequences see the PHP core documentation. Loading history...
|
|||
| 65 | } |
||
| 66 | } |
||
| 67 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.