db_mysql

Complexity

Total Complexity

153

Size/Duplication

Total Lines	947
Duplicated Lines	8.76 %

Coupling/Cohesion

Components	2
Dependencies	10

Test Coverage

Coverage

0%

Importance

Changes	27
Bugs	0	Features	0

66 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
A	load_db_settings()	0	9	2
C	sn_db_connect()	0	29	8
A	driver_connect()	0	11	3
A	db_disconnect()	0	8	2
A	replaceTablePlaceholders()	0	10	3
A	logQuery()	0	11	2
B	queryTrace()	0	19	7
B	doquery()	0	30	4
A	doExecute()	0	14	3
A	doSelect()	0	3	1
A	doSelectFetch()	0	3	1
A	doSelectFetchValue()	0	5	2
A	doInsertComplex()	0	3	1
A	doSet()	0	20	3
A	doInsertSet()	0	3	1
A	doReplaceSet()	0	3	1
A	doValuesDeprecated()	0	9	2
A	doInsertValuesDeprecated()	0	3	1
A	doReplaceValuesDeprecated()	0	3	1
A	doUpdateComplex()	0	3	1
A	doUpdateSqlNoParam()	0	3	1
B	doUpdateWhere()	0	22	5
A	doUpdateRowSet()	0	3	1
A	doUpdateTableSet()	0	3	1
A	doUpdateRowAdjust()	0	3	1
A	doUpdateTableAdjust()	0	3	1
A	doUpdateAdjustDeprecated()	0	3	1
A	doUpdateOld()	0	3	1
A	doDelete()	0	3	1
A	doDeleteWhere()	0	8	2
A	doDeleteRowWhere()	0	3	1
A	doDeleteComplex()	0	3	1
A	doDeleteDeprecated()	0	3	1
D	castAsDbValue()	0	30	9
B	safeFieldsEqualValues()	18	18	5
B	safeFieldsAdjust()	18	18	5
A	safeValues()	13	13	4
A	safeFields()	13	13	4
A	doSelectIterator()	0	11	2
A	doStmtLockAll()	0	10	1
B	security_watch_user_queries()	0	21	7
C	security_query_check_bad_words()	0	57	18
B	db_get_table_list()	0	20	5
A	db_prepare()	7	7	1
A	db_sql_query()	7	7	1
A	db_fetch()	7	7	1
A	db_fetch_row()	0	3	1
A	db_escape()	0	3	1
A	driver_disconnect()	0	3	1
A	db_error()	0	3	1
A	db_insert_id()	0	3	1
A	db_num_rows()	0	3	1
A	db_affected_rows()	0	3	1
A	db_get_client_info()	0	3	1
A	db_get_server_info()	0	3	1
A	db_get_host_info()	0	3	1
A	db_get_server_stat()	0	11	2
A	db_core_show_status()	0	13	3
A	mysql_get_table_list()	0	3	1
A	mysql_get_innodb_status()	0	3	1
A	getTransaction()	0	3	1
A	transactionCheck()	0	3	1
A	transactionStart()	0	3	1
A	transactionCommit()	0	3	1
A	transactionRollback()	0	3	1

<?php

define('DB_INSERT_PLAIN', 0);
define('DB_INSERT_REPLACE', 1);
define('DB_INSERT_IGNORE', 2);

define('DB_RECORDS_ALL', false);
define('DB_RECORD_ONE', true);

/**
 * Created by Gorlum 01.09.2015 15:58
 */
class db_mysql {
  const TRANSACTION_SERIALIZABLE = 'SERIALIZABLE';
  const TRANSACTION_REPEATABLE_READ = 'REPEATABLE READ';
  const TRANSACTION_READ_COMMITTED = 'READ COMMITTED';
  const TRANSACTION_READ_UNCOMMITTED = 'READ UNCOMMITTED';

  /**
   * Статус соеднения с MySQL
   *
   * @var bool
   */
  public $connected = false;
  /**
   * Префикс названий таблиц в БД
   *
   * @var string
   */
  public $db_prefix = '';
  /**
   * Список таблиц в БД
   *
   * @var array
   */
  public $table_list = array();

  /**
   * Настройки БД
   *
   * @var array
   */
  protected $dbsettings = array();
  /**
   * Драйвер для прямого обращения к MySQL
   *
   * @var db_mysql_v5 $driver
   */
  public $driver = null;

  /**
   * Общее время запросов
   *
   * @var float $time_mysql_total
   */
  public $time_mysql_total = 0.0;

  /**
   * Amount of queries on this DB
   *
   * @var int
   */
  public $queryCount = 0;

  public $isWatching = false;

  /**
   * @var \DBAL\DbTransaction $transaction
   */
  protected $transaction;

  /**
   * Should query check be skipped?
   *
   * Used for altering scheme of DB
   *
   * @var bool $skipQueryCheck
   */
  protected $skipQueryCheck = false;

  /**
   * @var SnCache $snCache
   */
  public $snCache;

  /**
   * db_mysql constructor.
   *
   * @param \Common\GlobalContainer $gc
   */
  public function __construct($gc) {
    $this->transaction = new \DBAL\DbTransaction($gc, $this);
    $this->snCache = new $gc->snCacheClass($gc, $this);
  }

  public function load_db_settings($configFile = '') {
    $dbsettings = array();

    empty($configFile) ? $configFile = SN_ROOT_PHYSICAL . "config" . DOT_PHP_EX : false;

    require $configFile;

    $this->dbsettings = $dbsettings;
  }

  /**
   * @param null|array $external_db_settings
   *
   * @return bool
   */
  public function sn_db_connect($external_db_settings = null) {
    $this->db_disconnect();

    if (!empty($external_db_settings) && is_array($external_db_settings)) {
      $this->dbsettings = $external_db_settings;
    }

    if (empty($this->dbsettings)) {
      $this->load_db_settings(SN_ROOT_PHYSICAL . "config" . DOT_PHP_EX);
    }

    // TODO - фатальные (?) ошибки на каждом шагу. Хотя - скорее Эксепшны
    if (!empty($this->dbsettings)) {
      $driver_name = empty($this->dbsettings['sn_driver']) ? 'db_mysql_v5' : $this->dbsettings['sn_driver'];
      $this->driver = new $driver_name();
      $this->db_prefix = $this->dbsettings['prefix'];

      $this->connected = $this->connected || $this->driver_connect();

      if ($this->connected) {
        $this->table_list = $this->db_get_table_list();
        // TODO Проверка на пустоту
      }
    } else {
      $this->connected = false;
    }

    return $this->connected;
  }

  protected function driver_connect() {
    if (!is_object($this->driver)) {
      classSupernova::$debug->error_fatal('DB Error - No driver for MySQL found!');
    }

    if (!method_exists($this->driver, 'mysql_connect')) {
      classSupernova::$debug->error_fatal('DB Error - WRONG MySQL driver!');
    }

    return $this->driver->mysql_connect($this->dbsettings);
  }

  public function db_disconnect() {
    if ($this->connected) {
      $this->connected = !$this->driver_disconnect();
      $this->connected = false;
    }

    return !$this->connected;
  }

  /**
   * @param string $query
   *
   * @return mixed|string
   */
  public function replaceTablePlaceholders($query) {
    $sql = $query;
    if (strpos($sql, '{{') !== false) {
      foreach ($this->table_list as $tableName) {
        $sql = str_replace("{{{$tableName}}}", $this->db_prefix . $tableName, $sql);
      }
    }

    return $sql;
  }

  /**
   * @param $query
   */
  protected function logQuery($query) {
    if (!classSupernova::$config->debug) {
      return;
    }

    $this->queryCount++;
    $arr = debug_backtrace();
    $file = end(explode('/', $arr[0]['file']));

explode('/', $arr[0]['file']) cannot be passed to end() as the parameter $array expects a reference.

    $line = $arr[0]['line'];
    classSupernova::$debug->add("<tr><th>Query {$this->queryCount}: </th><th>$query</th><th>{$file} @ {$line}</th><th>&nbsp;</th></tr>");
  }


  /**
   * @return string
   */
  public function queryTrace() {
    if (!defined('DEBUG_SQL_COMMENT') || constant('DEBUG_SQL_ERROR') !== true) {
      return '';
    }

    $backtrace = debug_backtrace();
    $sql_comment = classSupernova::$debug->compact_backtrace($backtrace, defined('DEBUG_SQL_COMMENT_LONG'));

    if (defined('DEBUG_SQL_ERROR') && constant('DEBUG_SQL_ERROR') === true) {
      classSupernova::$debug->add_to_array($sql_comment);
    }

    $sql_commented = implode("\r\n", $sql_comment);
    if (defined('DEBUG_SQL_ONLINE') && constant('DEBUG_SQL_ONLINE') === true) {
      classSupernova::$debug->warning($sql_commented, 'SQL Debug', LOG_DEBUG_SQL);
    }

    return $sql_commented;
  }

  /**
   * @param string $query
   *
   * @return array|bool|mysqli_result|null
   * @internal param bool $skip_query_check
   *
   */
  protected function doquery($query) {
    if (!$this->connected) {
      $this->sn_db_connect();
    }

    $stringQuery = $query;
    $stringQuery = trim($stringQuery);
    // You can't do it - 'cause you can break commented statement with line-end comments
    // $stringQuery = preg_replace("/\s+/", ' ', $stringQuery);

57% of this comment could be valid code. Did you maybe forget this after debugging?

    $this->security_watch_user_queries($stringQuery);
    $this->security_query_check_bad_words($stringQuery);
    $this->logQuery($stringQuery);

    $stringQuery = $this->replaceTablePlaceholders($stringQuery);

    $queryTrace = $this->queryTrace();

    $queryResult = null;
    try {
      $queryResult = $this->db_sql_query($stringQuery . DbSqlHelper::quoteComment($queryTrace));
      if (!$queryResult) {
        throw new Exception();
      }
    } catch (Exception $e) {
      classSupernova::$debug->error($this->db_error() . "<br />{$query}<br />", 'SQL Error');
    }

    return $queryResult;
  }


  // Just wrappers to distinguish query types
  /**
   * Executes non-data manipulation statements
   *
   * Can execute queries with check skip
   * Honor current state of query checking
   *
   * @param string $query
   * @param bool   $skip_query_check
   *
   * @return array|bool|mysqli_result|null
   */
  public function doExecute($query, $skip_query_check = false) {
    $prevState = false;
    if ($skip_query_check) {
      $prevState = $this->skipQueryCheck;
      $this->skipQueryCheck = true;
    }
    // TODO - disable watch ??
    $result = $this->doquery($query);
    if ($skip_query_check) {
      $this->skipQueryCheck = $prevState;
    }

    return $result;
  }


  public function doSelect($query) {
    return $this->doExecute($query);
  }

  /**
   * @param string $query
   *
   * @return array|null
   */
  public function doSelectFetch($query) {
    return $this->db_fetch($this->doSelect($query));

$this->doSelect($query) cannot be passed to db_fetch() as the parameter $query expects a reference.

It seems like $this->doSelect($query) targeting db_mysql::doSelect() can also be of type boolean; however, db_mysql::db_fetch() does only seem to accept object<mysqli_result>, maybe add an additional type check?

  }

  /**
   * @param string $query
   *
   * @return mixed|null
   */
  public function doSelectFetchValue($query) {
    $row = $this->doSelectFetch($query);

    return is_array($row) ? reset($row) : null;
  }


  public function doInsertComplex($query) {
    return $this->doExecute($query);
  }

  protected function doSet($table, $fieldsAndValues, $replace = DB_INSERT_PLAIN) {
    $tableSafe = $this->db_escape($table);
    $safeFieldsAndValues = implode(',', $this->safeFieldsEqualValues($fieldsAndValues));
//    $command = $replace == DB_INSERT_REPLACE ? 'REPLACE' : 'INSERT';
//    $command .= $replace == DB_INSERT_IGNORE ? ' IGNORE' : '';
    switch($replace) {
      case DB_INSERT_IGNORE:
        $command = 'INSERT IGNORE';
      break;
      case DB_INSERT_REPLACE:
        $command = 'REPLACE';
      break;
      default:
        $command = 'INSERT';
      break;
    }
    $query = "{$command} INTO `{{{$tableSafe}}}` SET {$safeFieldsAndValues}";

    return $this->doExecute($query);
  }

  /**
   * @param string $table
   * @param array  $fieldsAndValues
   * @param int    $replace - DB_INSERT_PLAIN || DB_INSERT_IGNORE
   *
   * @return array|bool|mysqli_result|null
   */
  public function doInsertSet($table, $fieldsAndValues, $replace = DB_INSERT_PLAIN) {
    return $this->doSet($table, $fieldsAndValues, $replace);
  }

  public function doReplaceSet($table, $fieldsAndValues) {
    return $this->doSet($table, $fieldsAndValues, DB_INSERT_REPLACE);
  }

  /**
   * Values should be passed as-is
   *
   * @param string   $table
   * @param array    $fields
   * @param string[] $values
   * @param bool     $replace
   *
   * @return array|bool|mysqli_result|null
   * @deprecated
   */
  protected function doValuesDeprecated($table, $fields, &$values, $replace = DB_INSERT_PLAIN) {
    $tableSafe = $this->db_escape($table);
    $safeFields = implode(',', $this->safeFields($fields));
    $safeValues = implode(',', $values);
    $command = $replace == DB_INSERT_REPLACE ? 'REPLACE' : 'INSERT';
    $query = "{$command} INTO `{{{$tableSafe}}}` ({$safeFields}) VALUES {$safeValues}";

    return $this->doExecute($query);
  }

  // TODO - batch insert and replace here

  // TODO - перед тем, как переделывать данные из депрекейтов - убедится, что
  // null - это null, а не строка'NULL'

  /**
   * Values should be passed as-is
   *
   * @param string   $table
   * @param array    $fields
   * @param string[] $values
   *
   * @return array|bool|mysqli_result|null
   * @deprecated
   */
  public function doInsertValuesDeprecated($table, $fields, &$values) {
    return $this->doValuesDeprecated($table, $fields, $values, DB_INSERT_PLAIN);

DB_INSERT_PLAIN is of type integer, but the function expects a boolean.

The method db_mysql::doValuesDeprecated() has been deprecated.

  }

  /**
   * Values should be passed as-is
   *
   * @param string   $table
   * @param array    $fields
   * @param string[] $values
   *
   * @return array|bool|mysqli_result|null
   * @deprecated
   */
  public function doReplaceValuesDeprecated($table, $fields, &$values) {
    return $this->doValuesDeprecated($table, $fields, $values, DB_INSERT_REPLACE);

DB_INSERT_REPLACE is of type integer, but the function expects a boolean.

The method db_mysql::doValuesDeprecated() has been deprecated.

  }


  public function doUpdateComplex($query) {
    return $this->doExecute($query);
  }

  /**
   * Executes self-contained SQL UPDATE query
   *
   * Self-contained - means no params used
   * Such queries usually used to make large amount of in-base calculations
   *
   * @param $query
   *
   * @return array|bool|mysqli_result|null
   */
  public function doUpdateSqlNoParam($query) {
    return $this->doExecute($query);
  }

  protected function doUpdateWhere($table, $fieldsSet, $fieldsAdjust = array(), $where = array(), $isOneRecord = DB_RECORDS_ALL) {
    $tableSafe = $this->db_escape($table);

    $safeFields = array();
    // Adjusts overwritten by Sets
    if($safeAdjust = implode(',', $this->safeFieldsAdjust($fieldsAdjust))) {
      $safeFields[] = &$safeAdjust;
    }
    if($safeFieldsEqualValues = implode(',', $this->safeFieldsEqualValues($fieldsSet))) {
      $safeFields[] = &$safeFieldsEqualValues;
    }
    $safeFieldsString = implode(',', $safeFields);

    // TODO - Exception of $safeFieldsString

    $safeWhereAnd = implode(' AND ', $this->safeFieldsEqualValues($where));
    $query = "UPDATE `{{{$tableSafe}}}` SET {$safeFieldsString}"
      . (!empty($safeWhereAnd) ? " WHERE {$safeWhereAnd}" : '')
      . ($isOneRecord == DB_RECORD_ONE ? ' LIMIT 1' : '');

    return $this->doExecute($query);
  }

  public function doUpdateRowSet($table, $fieldsAndValues, $where) {
    return $this->doUpdateWhere($table, $fieldsAndValues, array(), $where, DB_RECORD_ONE);
  }

  public function doUpdateTableSet($table, $fieldsAndValues, $where = array()) {
    return $this->doUpdateWhere($table, $fieldsAndValues, array(), $where, DB_RECORDS_ALL);
  }

  public function doUpdateRowAdjust($table, $fieldsSet, $fieldsAdjust, $where) {
    return $this->doUpdateWhere($table, $fieldsSet, $fieldsAdjust, $where, DB_RECORD_ONE);
  }

  public function doUpdateTableAdjust($table, $fieldsSet, $fieldsAdjust, $where) {
    return $this->doUpdateWhere($table, $fieldsSet, $fieldsAdjust, $where, DB_RECORDS_ALL);
  }

  public function doUpdateAdjustDeprecated($query) {
    return $this->doExecute($query);
  }



  /**
   * For update_old - would be deprecated
   *
   * @param string $query
   *
   * @return array|bool|mysqli_result|null
   * @deprecated
   */
  public function doUpdateOld($query) {
    return $this->doExecute($query);
  }


  /**
   * @param string $query
   *
   * @return array|bool|mysqli_result|null
   */
  public function doDelete($query) {
    return $this->doExecute($query);
  }

  /**
   * @param string $table
   * @param array  $where - simple WHERE statement list which can be combined with AND
   * @param bool   $isOneRecord
   *
   * @return array|bool|mysqli_result|null
   */
  public function doDeleteWhere($table, $where, $isOneRecord = false) {
    $tableSafe = $this->db_escape($table);
    $safeWhere = implode(' AND ', $this->safeFieldsEqualValues($where));
    $query = "DELETE FROM `{{{$tableSafe}}}` WHERE {$safeWhere}"
      . ($isOneRecord ? ' LIMIT 1' : '');

    return $this->doDelete($query);
  }

  /**
   * @param string $table
   * @param array  $where - simple WHERE statement list which can be combined with AND
   *
   * @return array|bool|mysqli_result|null
   */
  public function doDeleteRowWhere($table, $where) {
    return $this->doDeleteWhere($table, $where, true);
  }

  /**
   * @param string $query
   *
   * @return array|bool|mysqli_result|null
   */
  public function doDeleteComplex($query) {
    return $this->doDelete($query);
  }

  /**
   * Early deprecated function for complex delete conditions
   *
   * Usually used for mallformed $where conditions
   *
   * @param $table
   * @param $where
   *
   * @return array|bool|mysqli_result|null
   * @deprecated
   */
  public function doDeleteDeprecated($table, $where) {
    return $this->doDeleteWhere($table, $where, false);
  }


  protected function castAsDbValue($value) {
    switch(gettype($value)) {
      case TYPE_INTEGER:
      case TYPE_DOUBLE:
        // do nothing
      break;

      case TYPE_BOOLEAN:
        $value = $value ? 1 : 0;
      break;

      case TYPE_NULL:
        $value = 'NULL';
      break;

      /** @noinspection PhpMissingBreakStatementInspection */
      case TYPE_ARRAY:
        $value = serialize($value);
      // Continuing with serialized array value
      case TYPE_STRING:
        // Empty type is string
      case TYPE_EMPTY:
        // No-type defaults to string
      default:
        $value = "'" . $this->db_escape((string)$value) . "'";
      break;
    }

    return $value;
  }

  /**
   * Make field list safe
   *
   * Support expressions - expression index should be strictly integer!
   *
   * @param array $fields - array of pair $fieldName => $fieldValue
   *
   * @return array
   */
  protected function safeFieldsEqualValues($fields) {

This method seems to be duplicated in your project.

    $result = array();

    if (!is_array($fields) || empty($fields)) {
      return $result;
    }

    foreach ($fields as $fieldName => $fieldValue) {
      // Integer $fieldName means "leave as is" - for expressions and already processed fields
      if (is_int($fieldName)) {
        $result[$fieldName] = $fieldValue;
      } else {
        $result[$fieldName] = "`{$fieldName}` = " . $this->castAsDbValue($fieldValue);
      }
    }

    return $result;
  }

  /**
   * Make fields adjustment safe
   *
   * Convert "key => value" pair to string "`key` = `key` + (value)"
   * Supports expressions - expression index should be strictly integer!
   *
   * @param array $fields - array of pair $fieldName => $fieldValue
   *
   * @return array
   */
  protected function safeFieldsAdjust($fields) {

This method seems to be duplicated in your project.

    $result = array();

    if (!is_array($fields) || empty($fields)) {
      return $result;
    }

    foreach ($fields as $fieldName => $fieldValue) {
      // Integer $fieldName means "leave as is" - for expressions and already processed fields
      if (is_int($fieldName)) {
        $result[$fieldName] = $fieldValue;
      } else {
        $result[$fieldName] = "`{$fieldName}` = `{$fieldName}` + (" . $this->castAsDbValue($fieldValue) . ")";
      }
    }

    return $result;
  }

  // TODO - redo as callable usage with array_map/array_walk
  public function safeValues($values) {

This method seems to be duplicated in your project.

    $result = array();

    if (!is_array($values) || empty($values)) {
      return $result;
    }

    foreach ($values as $key => $value) {
      $result[$key] = $this->castAsDbValue($value);
    }

    return $result;
  }

  // TODO - redo as callable usage with array_map/array_walk
  public function safeFields($fields) {

This method seems to be duplicated in your project.

    $result = array();

    if (!is_array($fields) || empty($fields)) {
      return $result;
    }

    foreach ($fields as $key => $value) {
      $result[$key] = "`" . $this->db_escape($value) . "`";
    }

    return $result;
  }


  /**
   * Returns iterator to iterate through mysqli_result
   *
   * @param string $query
   *
   * return DbResultIterator
   *
   * @return DbEmptyIterator|DbMysqliResultIterator
   */
  public function doSelectIterator($query) {
    $queryResult = $this->doSelect($query);

    if ($queryResult instanceof mysqli_result) {
      $result = new DbMysqliResultIterator($queryResult);
    } else {
      $result = new DbEmptyIterator();
    }

    return $result;
  }

  /**
   * @param DbQueryConstructor $stmt
   * @param bool               $skip_query_check
   */
  public function doStmtLockAll($stmt, $skip_query_check = false) {
    $this->doExecute(
      $stmt
        ->select()
        ->field(1)
        ->setForUpdate()
        ->__toString(),
      $skip_query_check
    );
  }

  // TODO Заменить это на новый логгер
  protected function security_watch_user_queries($query) {
    global $user;

    if (
      !$this->isWatching // Not already watching
      && !empty(classSupernova::$config->game_watchlist_array) // There is some players in watchlist
      && in_array($user['id'], classSupernova::$config->game_watchlist_array) // Current player is in watchlist
      && !preg_match('/^(select|commit|rollback|start transaction)/i', $query) // Current query should be watched
    ) {
      $this->isWatching = true;
      $msg = "\$query = \"{$query}\"\n\r";
      if (!empty($_POST)) {
        $msg .= "\n\r" . dump($_POST, '$_POST');
      }
      if (!empty($_GET)) {
        $msg .= "\n\r" . dump($_GET, '$_GET');
      }
      classSupernova::$debug->warning($msg, "Watching user {$user['id']}", 399, array('base_dump' => true));

array('base_dump' => true) is of type array<string,boolean,{"base_dump":"boolean"}>, but the function expects a boolean.

      $this->isWatching = false;
    }
  }


  public function security_query_check_bad_words($query) {
    if ($this->skipQueryCheck) {
      return;
    }

    global $user, $dm_change_legit, $mm_change_legit;

    switch(true) {
      case stripos($query, 'RUNCATE TABL') != false:

It seems like you are loosely comparing stripos($query, 'RUNCATE TABL') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'ROP TABL') != false:

It seems like you are loosely comparing stripos($query, 'ROP TABL') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'ENAME TABL') != false:

It seems like you are loosely comparing stripos($query, 'ENAME TABL') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'REATE DATABAS') != false:

It seems like you are loosely comparing stripos($query, 'REATE DATABAS') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'REATE TABL') != false:

It seems like you are loosely comparing stripos($query, 'REATE TABL') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'ET PASSWOR') != false:

It seems like you are loosely comparing stripos($query, 'ET PASSWOR') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'EOAD DAT') != false:

It seems like you are loosely comparing stripos($query, 'EOAD DAT') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'RPG_POINTS') != false && stripos(trim($query), 'UPDATE ') === 0 && !$dm_change_legit:

It seems like you are loosely comparing stripos($query, 'RPG_POINTS') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'METAMATTER') != false && stripos(trim($query), 'UPDATE ') === 0 && !$mm_change_legit:

It seems like you are loosely comparing stripos($query, 'METAMATTER') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

      case stripos($query, 'AUTHLEVEL') != false && $user['authlevel'] < 3 && stripos($query, 'SELECT') !== 0:

It seems like you are loosely comparing stripos($query, 'AUTHLEVEL') of type integer to the boolean false. If you are specifically checking for non-zero, consider using something more explicit like > 0 or !== 0 instead.

        $report = "Hacking attempt (" . date("d.m.Y H:i:s") . " - [" . time() . "]):\n";
        $report .= ">Database Inforamation\n";
        $report .= "\tID - " . $user['id'] . "\n";
        $report .= "\tUser - " . $user['username'] . "\n";
        $report .= "\tAuth level - " . $user['authlevel'] . "\n";
        $report .= "\tAdmin Notes - " . $user['adminNotes'] . "\n";
        $report .= "\tCurrent Planet - " . $user['current_planet'] . "\n";
        $report .= "\tUser IP - " . $user['user_lastip'] . "\n";
        $report .= "\tUser IP at Reg - " . $user['ip_at_reg'] . "\n";
        $report .= "\tUser Agent- " . $_SERVER['HTTP_USER_AGENT'] . "\n";
        $report .= "\tCurrent Page - " . $user['current_page'] . "\n";
        $report .= "\tRegister Time - " . $user['register_time'] . "\n";
        $report .= "\n";

        $report .= ">Query Information\n";
        $report .= "\tQuery - " . $query . "\n";
        $report .= "\n";

        $report .= ">\$_SERVER Information\n";
        $report .= "\tIP - " . $_SERVER['REMOTE_ADDR'] . "\n";
        $report .= "\tHost Name - " . $_SERVER['HTTP_HOST'] . "\n";
        $report .= "\tUser Agent - " . $_SERVER['HTTP_USER_AGENT'] . "\n";
        $report .= "\tRequest Method - " . $_SERVER['REQUEST_METHOD'] . "\n";
        $report .= "\tCame From - " . $_SERVER['HTTP_REFERER'] . "\n";
        $report .= "\tPage is - " . $_SERVER['SCRIPT_NAME'] . "\n";
        $report .= "\tUses Port - " . $_SERVER['REMOTE_PORT'] . "\n";
        $report .= "\tServer Protocol - " . $_SERVER['SERVER_PROTOCOL'] . "\n";

        $report .= "\n--------------------------------------------------------------------------------------------------\n";

        $fp = fopen(SN_ROOT_PHYSICAL . 'badqrys.txt', 'a');
        fwrite($fp, $report);

        fclose($fp);

        $message = 'Привет, я не знаю то, что Вы пробовали сделать, но команда, которую Вы только послали базе данных, не выглядела очень дружественной и она была заблокированна.<br /><br />Ваш IP, и другие данные переданны администрации сервера. Удачи!.';
        die($message);
      break;

break; does not seem to be reachable.

    }
  }

  /**
   * @param bool $prefixed_only
   *
   * @return array
   */
  public function db_get_table_list($prefixed_only = true) {
    $query = $this->mysql_get_table_list();

    $prefix_length = strlen($this->db_prefix);

    $tl = array();
    while($row = $this->db_fetch($query)) {

It seems like $query defined by $this->mysql_get_table_list() on line 783 can also be of type boolean; however, db_mysql::db_fetch() does only seem to accept object<mysqli_result>, maybe add an additional type check?

      foreach ($row as $table_name) {
        if (strpos($table_name, $this->db_prefix) === 0) {
          $table_name = substr($table_name, $prefix_length);
        } elseif ($prefixed_only) {
          continue;
        }
        // $table_name = str_replace($db_prefix, '', $table_name);

57% of this comment could be valid code. Did you maybe forget this after debugging?

        $tl[$table_name] = $table_name;
      }
    }

    return $tl;
  }

  /**
   * @param string $statement
   *
   * @return bool|mysqli_stmt
   */
  public function db_prepare($statement) {

This method seems to be duplicated in your project.

    $microtime = microtime(true);
    $result = $this->driver->mysql_prepare($statement);
    $this->time_mysql_total += microtime(true) - $microtime;

    return $result;
  }


  /**
   * L1 perform the query
   *
   * @param $query_string
   *
   * @return bool|mysqli_result
   */
  public function db_sql_query($query_string) {

This method seems to be duplicated in your project.

    $microtime = microtime(true);
    $result = $this->driver->mysql_query($query_string);
    $this->time_mysql_total += microtime(true) - $microtime;

    return $result;
  }

  /**
   * L1 fetch assoc array
   *
   * @param mysqli_result $query
   *
   * @return array|null
   */
  public function db_fetch(&$query) {

This method seems to be duplicated in your project.

    $microtime = microtime(true);
    $result = $this->driver->mysql_fetch_assoc($query);
    $this->time_mysql_total += microtime(true) - $microtime;

    return $result;
  }

  public function db_fetch_row(&$query) {
    return $this->driver->mysql_fetch_row($query);
  }

  public function db_escape($unescaped_string) {
    return $this->driver->mysql_real_escape_string($unescaped_string);
  }

  public function driver_disconnect() {
    return $this->driver->mysql_close_link();
  }

  public function db_error() {
    return $this->driver->mysql_error();
  }

  public function db_insert_id() {
    return $this->driver->mysql_insert_id();
  }

  public function db_num_rows(&$result) {
    return $this->driver->mysql_num_rows($result);
  }

  public function db_affected_rows() {
    return $this->driver->mysql_affected_rows();
  }

  /**
   * @return string
   */
  public function db_get_client_info() {
    return $this->driver->mysql_get_client_info();
  }

  /**
   * @return string
   */
  public function db_get_server_info() {
    return $this->driver->mysql_get_server_info();
  }

  /**
   * @return string
   */
  public function db_get_host_info() {
    return $this->driver->mysql_get_host_info();
  }

  public function db_get_server_stat() {
    $result = array();

    $status = explode('  ', $this->driver->mysql_stat());
    foreach ($status as $value) {
      $row = explode(': ', $value);
      $result[$row[0]] = $row[1];
    }

    return $result;
  }

  /**
   * @return array
   * @throws Exception
   */
  public function db_core_show_status() {
    $result = array();

    $query = $this->db_sql_query('SHOW STATUS;');
    if (is_bool($query)) {
      throw new Exception('Result of SHOW STATUS command is boolean - which should never happen. Connection to DB is lost?');
    }
    while($row = db_fetch($query)) {
      $result[$row['Variable_name']] = $row['Value'];
    }

    return $result;
  }

  public function mysql_get_table_list() {
    return $this->db_sql_query('SHOW TABLES;');
  }

  public function mysql_get_innodb_status() {
    return $this->db_sql_query('SHOW ENGINE INNODB STATUS;');
  }

  /**
   * @return \DBAL\DbTransaction
   */
  public function getTransaction() {
    return $this->transaction;
  }

  // Some wrappers to DbTransaction
  // Unused for now
  public function transactionCheck($status = null) {
    return $this->transaction->check($status);
  }

  public function transactionStart($level = '') {
    return $this->transaction->start($level);
  }

  public function transactionCommit() {
    return $this->transaction->commit();
  }

  public function transactionRollback() {
    return $this->transaction->rollback();
  }

}