This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace SilverStripe\SQLite; |
||
4 | |||
5 | use SilverStripe\ORM\Connect\DBConnector; |
||
6 | use SQLite3; |
||
7 | |||
8 | /** |
||
9 | * SQLite connector class |
||
10 | * |
||
11 | * @package SQLite3 |
||
12 | */ |
||
13 | class SQLite3Connector extends DBConnector |
||
14 | { |
||
15 | |||
16 | /** |
||
17 | * The name of the database. |
||
18 | * |
||
19 | * @var string |
||
20 | */ |
||
21 | protected $databaseName; |
||
22 | |||
23 | /** |
||
24 | * Connection to the DBMS. |
||
25 | * |
||
26 | * @var SQLite3 |
||
27 | */ |
||
28 | protected $dbConn; |
||
29 | |||
30 | public function connect($parameters, $selectDB = false) |
||
31 | { |
||
32 | $file = $parameters['filepath']; |
||
33 | $this->dbConn = empty($parameters['key']) |
||
34 | ? new SQLite3($file, SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE) |
||
35 | : new SQLite3($file, SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE, $parameters['key']); |
||
36 | $this->dbConn->busyTimeout(60000); |
||
37 | $this->databaseName = $parameters['database']; |
||
38 | } |
||
39 | |||
40 | public function affectedRows() |
||
41 | { |
||
42 | return $this->dbConn->changes(); |
||
43 | } |
||
44 | |||
45 | public function getGeneratedID($table) |
||
46 | { |
||
47 | return $this->dbConn->lastInsertRowID(); |
||
48 | } |
||
49 | |||
50 | public function getLastError() |
||
51 | { |
||
52 | $message = $this->dbConn->lastErrorMsg(); |
||
53 | return $message === 'not an error' ? null : $message; |
||
54 | } |
||
55 | |||
56 | public function getSelectedDatabase() |
||
57 | { |
||
58 | return $this->databaseName; |
||
59 | } |
||
60 | |||
61 | public function getVersion() |
||
62 | { |
||
63 | $version = SQLite3::version(); |
||
64 | return trim($version['versionString']); |
||
65 | } |
||
66 | |||
67 | public function isActive() |
||
68 | { |
||
69 | return $this->databaseName && $this->dbConn; |
||
70 | } |
||
71 | |||
72 | /** |
||
73 | * Prepares the list of parameters in preparation for passing to mysqli_stmt_bind_param |
||
74 | * |
||
75 | * @param array $parameters List of parameters |
||
76 | * @return array List of parameters types and values |
||
77 | */ |
||
78 | public function parsePreparedParameters($parameters) |
||
79 | { |
||
80 | $values = array(); |
||
81 | foreach ($parameters as $value) { |
||
82 | $phpType = gettype($value); |
||
83 | $sqlType = null; |
||
84 | |||
85 | // Allow overriding of parameter type using an associative array |
||
86 | if ($phpType === 'array') { |
||
87 | $phpType = $value['type']; |
||
88 | $value = $value['value']; |
||
89 | } |
||
90 | |||
91 | // Convert php variable type to one that makes mysqli_stmt_bind_param happy |
||
92 | // @see http://www.php.net/manual/en/mysqli-stmt.bind-param.php |
||
93 | switch ($phpType) { |
||
94 | case 'boolean': |
||
95 | case 'integer': |
||
96 | $sqlType = SQLITE3_INTEGER; |
||
97 | break; |
||
98 | case 'float': // Not actually returnable from gettype |
||
99 | case 'double': |
||
100 | $sqlType = SQLITE3_FLOAT; |
||
101 | break; |
||
102 | case 'object': // Allowed if the object or resource has a __toString method |
||
103 | case 'resource': |
||
104 | case 'string': |
||
105 | $sqlType = SQLITE3_TEXT; |
||
106 | break; |
||
107 | case 'NULL': |
||
108 | $sqlType = SQLITE3_NULL; |
||
109 | break; |
||
110 | case 'blob': |
||
111 | $sqlType = SQLITE3_BLOB; |
||
112 | break; |
||
113 | case 'array': |
||
114 | case 'unknown type': |
||
115 | default: |
||
116 | user_error("Cannot bind parameter \"$value\" as it is an unsupported type ($phpType)", E_USER_ERROR); |
||
117 | break; |
||
118 | } |
||
119 | $values[] = array( |
||
120 | 'type' => $sqlType, |
||
121 | 'value' => $value |
||
122 | ); |
||
123 | } |
||
124 | return $values; |
||
125 | } |
||
126 | |||
127 | public function preparedQuery($sql, $parameters, $errorLevel = E_USER_ERROR) |
||
128 | { |
||
129 | // Type check, identify, and prepare parameters for passing to the statement bind function |
||
130 | $parsedParameters = $this->parsePreparedParameters($parameters); |
||
131 | |||
132 | // Prepare statement |
||
133 | $statement = @$this->dbConn->prepare($sql); |
||
134 | if ($statement) { |
||
135 | // Bind and run to statement |
||
136 | for ($i = 0; $i < count($parsedParameters); $i++) { |
||
0 ignored issues
–
show
|
|||
137 | $value = $parsedParameters[$i]['value']; |
||
138 | $type = $parsedParameters[$i]['type']; |
||
139 | $statement->bindValue($i+1, $value, $type); |
||
140 | } |
||
141 | |||
142 | // Return successful result |
||
143 | $handle = $statement->execute(); |
||
144 | if ($handle) { |
||
145 | return new SQLite3Query($this, $handle); |
||
146 | } |
||
147 | } |
||
148 | |||
149 | // Handle error |
||
150 | $values = $this->parameterValues($parameters); |
||
151 | $this->databaseError($this->getLastError(), $errorLevel, $sql, $values); |
||
152 | return null; |
||
153 | } |
||
154 | |||
155 | public function query($sql, $errorLevel = E_USER_ERROR) |
||
156 | { |
||
157 | // Return successful result |
||
158 | $handle = @$this->dbConn->query($sql); |
||
159 | if ($handle) { |
||
160 | return new SQLite3Query($this, $handle); |
||
161 | } |
||
162 | |||
163 | // Handle error |
||
164 | $this->databaseError($this->getLastError(), $errorLevel, $sql); |
||
165 | return null; |
||
166 | } |
||
167 | |||
168 | public function quoteString($value) |
||
169 | { |
||
170 | return "'".$this->escapeString($value)."'"; |
||
171 | } |
||
172 | |||
173 | public function escapeString($value) |
||
174 | { |
||
175 | return $this->dbConn->escapeString($value); |
||
176 | } |
||
177 | |||
178 | public function selectDatabase($name) |
||
179 | { |
||
180 | if ($name !== $this->databaseName) { |
||
181 | user_error("SQLite3Connector can't change databases. Please create a new database connection", E_USER_ERROR); |
||
182 | } |
||
183 | return true; |
||
184 | } |
||
185 | |||
186 | public function unloadDatabase() |
||
187 | { |
||
188 | $this->dbConn->close(); |
||
189 | $this->databaseName = null; |
||
190 | } |
||
191 | } |
||
192 |
If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: