Test Failed
Push — trunk ( db071f...8d464a )
by SuperNova.WS
06:33
created

debug::compact_backtrace()   C

Complexity

Conditions 7
Paths 20

Size

Total Lines 34
Code Lines 21

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 7
eloc 21
nc 20
nop 2
dl 0
loc 34
rs 6.7272
c 0
b 0
f 0
1
<?php
2
/*
3
 * debug.php ::  Clase Debug, maneja reporte de eventos
4
 *
5
 * V4.0 copyright 2010-2011 by Gorlum for http://supernova.ws
6
 *  [!] Merged `errors` to `logs`
7
 *  [+] Now debugger can work with database detached. All messages would be dumped to page
8
 *  [+] Now `logs` has both human-readable and machine-readable fields
9
 *
10
 * V3.0 copyright 2010 by Gorlum for http://supernova.ws
11
 *  [+] Full rewrtie & optimize
12
 *  [*] Now there is fallback procedure if no link to db detected
13
 *
14
 * V2.0 copyright 2010 by Gorlum for http://supernova.ws
15
 *  [*] Now error also contains backtrace - to see exact way problem comes
16
 *  [*] New method 'warning' sends message to dedicated SQL-table for non-errors
17
 *
18
 * V1.0 Created by Perberos. All rights reversed (C) 2006
19
 *
20
 *  Experiment code!!!
21
 *
22
 * vamos a experimentar >:)
23
 * le veo futuro a las classes, ayudaria mucho a tener un codigo mas ordenado...
24
 * que esperabas!!! soy newbie!!! D':<
25
*/
26
27
if(!defined('INSIDE')) {
28
  die("attemp hacking");
29
}
30
31
class debug {
32
  var $log, $numqueries;
33
  var $log_array;
34
35
  private $log_file_handler = null;
36
37
  function log_file($message, $ident_change = 0) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
38
    static $ident = 0;
39
40
    if(!defined('SN_DEBUG_LOG')) {
41
      return;
42
    }
43
44
    if($this->log_file_handler === null) {
45
      $this->log_file_handler = @fopen(SN_ROOT_PHYSICAL . '/.logs/supernova.log', 'a+');
46
      @fwrite($this->log_file_handler, "\r\n\r\n");
0 ignored issues
show
Security Best Practice introduced by
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

If you suppress an error, we recommend checking for the error condition explicitly:

// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
Loading history...
47
    }
48
    $ident_change < 0 ? $ident += $ident_change * 2 : false;
49
    if($this->log_file_handler) {
50
      @fwrite($this->log_file_handler, date(FMT_DATE_TIME_SQL, time()) . str_repeat(' ', $ident + 1) . $message . "\r\n");
0 ignored issues
show
Security Best Practice introduced by
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

If you suppress an error, we recommend checking for the error condition explicitly:

// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
Loading history...
51
    }
52
    $ident_change > 0 ? $ident += $ident_change * 2 : false;
53
  }
54
55
  public function __construct() {
56
    $this->vars = $this->log = '';
0 ignored issues
show
Bug introduced by
The property vars does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
57
    $this->numqueries = 0;
58
  }
59
60
  function add($mes) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
61
    $this->log .= $mes;
62
    $this->numqueries++;
63
  }
64
65
  function add_to_array($mes) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
66
    $this->log_array[] = $mes;
67
  }
68
69
  function echo_log() {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
70
    echo '<br><table><tr><td class=k colspan=4><a href="' . SN_ROOT_PHYSICAL . "admin/settings.php\">Debug Log</a>:</td></tr>{$this->log}</table>";
71
    die();
72
  }
73
74
  function compact_backtrace($backtrace, $long_comment = false) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
75
    static $exclude_functions = array(
76
//      'doquery',
0 ignored issues
show
Unused Code Comprehensibility introduced by
60% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
77
//      'db_query_select', 'db_query_delete', 'db_query_insert', 'db_query_update',
78
//      'db_get_record_list', 'db_user_by_id', 'db_get_user_by_id'
79
    );
80
81
    $result = array();
82
    $transaction_id = classSupernova::db_transaction_check(false) ? classSupernova::$transaction_id : classSupernova::$transaction_id++;
83
    $result[] = "tID {$transaction_id}";
84
    foreach($backtrace as $a_trace) {
85
      if(in_array($a_trace['function'], $exclude_functions)) {
86
        continue;
87
      }
88
      $function =
89
        ($a_trace['type']
90
          ? ($a_trace['type'] == '->'
91
            ? "({$a_trace['class']})" . get_class($a_trace['object'])
92
            : $a_trace['class']
93
          ) . $a_trace['type']
94
          : ''
95
        ) . $a_trace['function'] . '()';
96
97
      $file = str_replace(SN_ROOT_PHYSICAL, '', str_replace('\\', '/', $a_trace['file']));
98
99
      $result[] = "{$function} - '{$file}' Line {$a_trace['line']}";
100
101
      if(!$long_comment) {
102
        break;
103
      }
104
    }
105
106
    return $result;
107
  }
108
109
  function dump($dump = false, $force_base = false, $deadlock = false) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
110
    if($dump === false) {
111
      return;
112
    }
113
114
    $error_backtrace = array();
115
    $base_dump = false;
116
117
    if($force_base === true) {
118
      $base_dump = true;
119
    }
120
121
    if($dump === true) {
122
      $base_dump = true;
123
    } else {
124
      if(!is_array($dump)) {
125
        $dump = array('var' => $dump);
126
      }
127
128
      foreach($dump as $dump_var_name => $dump_var) {
129
        if($dump_var_name == 'base_dump') {
130
          $base_dump = $dump_var;
131
        } else {
132
          $error_backtrace[$dump_var_name] = $dump_var;
133
        }
134
      }
135
    }
136
137
    if($deadlock && ($q = db_fetch(classSupernova::$db->mysql_get_innodb_status()))) {
0 ignored issues
show
Bug introduced by
\classSupernova::$db->mysql_get_innodb_status() cannot be passed to db_fetch() as the parameter $query expects a reference.
Loading history...
138
      $error_backtrace['deadlock'] = explode("\n", $q['Status']);
139
      $error_backtrace['locks'] = classSupernova::$locks;
140
      $error_backtrace['cSN_data'] = classSupernova::$data;
141
      foreach($error_backtrace['cSN_data'] as &$location) {
142
        foreach($location as $location_id => &$location_data) //          $location_data = $location_id;
0 ignored issues
show
Unused Code Comprehensibility introduced by
43% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
143
        {
144
          $location_data = isset($location_data['username']) ? $location_data['username'] :
145
            (isset($location_data['name']) ? $location_data['name'] : $location_id);
146
        }
147
      }
148
      $error_backtrace['cSN_queries'] = classSupernova::$queries;
149
    }
150
151
    if($base_dump) {
152
      if(is_array($this->log_array) && count($this->log_array) > 0) {
153
        ;
154
      }
155
      {
156
        foreach($this->log_array as $log) {
157
          $error_backtrace['queries'][] = $log;
158
        }
159
      }
160
161
      $error_backtrace['backtrace'] = debug_backtrace();
162
      unset($error_backtrace['backtrace'][1]);
163
      unset($error_backtrace['backtrace'][0]);
164
      // $error_backtrace['query_log'] = "\r\n\r\nQuery log\r\n<table><tr><th>Number</th><th>Query</th><th>Page</th><th>Table</th><th>Rows</th></tr>{$this->log}</table>\r\n";
0 ignored issues
show
Unused Code Comprehensibility introduced by
60% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
165
      $error_backtrace['$_GET'] = $_GET;
166
      $error_backtrace['$_POST'] = $_POST;
167
      $error_backtrace['$_REQUEST'] = $_REQUEST;
168
      $error_backtrace['$_COOKIE'] = $_COOKIE;
169
      $error_backtrace['$_SESSION'] = $_SESSION;
170
      $error_backtrace['$_SERVER'] = $_SERVER;
171
      global $user, $planetrow;
172
      $error_backtrace['user'] = $user;
173
      $error_backtrace['planetrow'] = $planetrow;
174
    }
175
176
    return $error_backtrace;
177
  }
178
179
  function error_fatal($die_message, $details = 'There is a fatal error on page') {
0 ignored issues
show
Unused Code introduced by
The parameter $details is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
180
    // TODO - Записывать детали ошибки в лог-файл
181
    die($die_message);
182
  }
183
184
  function error($message = 'There is a error on page', $title = 'Internal Error', $error_code = 500, $dump = true) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
185
    global $config, $sys_stop_log_hit, $lang, $sys_log_disabled, $user;
186
187
    if(empty(classSupernova::$db->connected)) {
188
      // TODO - писать ошибку в файл
189
      die('SQL server currently unavailable. Please contact Administration...');
190
    }
191
192
    sn_db_transaction_rollback();
193
194
    if(classSupernova::$config->debug == 1) {
0 ignored issues
show
Documentation introduced by
The property debug does not exist on object<classConfig>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
195
      echo "<h2>{$title}</h2><br><font color=red>{$message}</font><br><hr>";
196
      echo "<table>{$this->log}</table>";
197
    }
198
199
    $fatal_error = 'Fatal error: cannot write to `logs` table. Please contact Administration...';
200
201
    $error_text = db_escape($message);
202
    $error_backtrace = $this->dump($dump, true, strpos($message, 'Deadlock') !== false);
203
204
    if(!$sys_log_disabled) {
205
      $query = "INSERT INTO `{{logs}}` SET
206
        `log_time` = '" . time() . "', `log_code` = '" . db_escape($error_code) . "', `log_sender` = '" . ($user['id'] ? db_escape($user['id']) : 0) . "',
207
        `log_username` = '" . db_escape($user['user_name']) . "', `log_title` = '" . db_escape($title) . "',  `log_text` = '" . db_escape($message) . "',
208
        `log_page` = '" . db_escape(strpos($_SERVER['SCRIPT_NAME'], SN_ROOT_RELATIVE) === false ? $_SERVER['SCRIPT_NAME'] : substr($_SERVER['SCRIPT_NAME'], strlen(SN_ROOT_RELATIVE))) . "'" .
209
        ", `log_dump` = '" . ($error_backtrace ? db_escape(serialize($error_backtrace)) : '') . "'" . ";";
210
      doquery($query, '', false, true) or die($fatal_error . db_error());
211
212
      $message = "Пожалуйста, свяжитесь с админом, если ошибка повторится. Ошибка №: <b>" . db_insert_id() . "</b>";
213
214
      $sys_stop_log_hit = true;
215
      $sys_log_disabled = true;
216
      !function_exists('messageBox') ? die($message) : messageBox($message, 'Ошибка', '', 0, false);
217
    } else {
218
//        // TODO Здесь надо писать в файло
219
      ob_start();
220
      print("<hr>User ID {$user['id']} raised error code {$error_code} titled '{$title}' with text '{$error_text}' on page {$_SERVER['SCRIPT_NAME']}");
221
222
      foreach($error_backtrace as $name => $value) {
0 ignored issues
show
Bug introduced by
The expression $error_backtrace of type null|array is not guaranteed to be traversable. How about adding an additional type check?

There are different options of fixing this problem.

  1. If you want to be on the safe side, you can add an additional type-check:

    $collection = json_decode($data, true);
    if ( ! is_array($collection)) {
        throw new \RuntimeException('$collection must be an array.');
    }
    
    foreach ($collection as $item) { /** ... */ }
    
  2. If you are sure that the expression is traversable, you might want to add a doc comment cast to improve IDE auto-completion and static analysis:

    /** @var array $collection */
    $collection = json_decode($data, true);
    
    foreach ($collection as $item) { /** .. */ }
    
  3. Mark the issue as a false-positive: Just hover the remove button, in the top-right corner of this issue for more options.

Loading history...
223
        print('<hr>');
224
        pdump($value, $name);
225
      }
226
      ob_end_flush();
227
      die();
228
    }
229
  }
230
231
  function warning($message, $title = 'System Message', $log_code = 300, $dump = false) {
0 ignored issues
show
Best Practice introduced by
It is generally recommended to explicitly declare the visibility for methods.

Adding explicit visibility (private, protected, or public) is generally recommend to communicate to other developers how, and from where this method is intended to be used.

Loading history...
232
    global $user, $lang, $sys_log_disabled;
233
234
    if(empty(classSupernova::$db->connected)) {
235
      // TODO - писать ошибку в файл
236
      die('SQL server currently unavailable. Please contact Administration...');
237
    }
238
239
    $error_backtrace = $this->dump($dump, false);
240
241
    if(!$sys_log_disabled) {
242
      $query = "INSERT INTO `{{logs}}` SET
243
        `log_time` = '" . time() . "', `log_code` = '" . db_escape($log_code) . "', `log_sender` = '" . ($user['id'] ? db_escape($user['id']) : 0) . "',
244
        `log_username` = '" . db_escape($user['user_name']) . "', `log_title` = '" . db_escape($title) . "',  `log_text` = '" . db_escape($message) . "',
245
        `log_page` = '" . db_escape(strpos($_SERVER['SCRIPT_NAME'], SN_ROOT_RELATIVE) === false ? $_SERVER['SCRIPT_NAME'] : substr($_SERVER['SCRIPT_NAME'], strlen(SN_ROOT_RELATIVE))) . "'" .
246
        ", `log_dump` = '" . ($error_backtrace ? db_escape(serialize($error_backtrace)) : '') . "'" . ";";
247
      doquery($query, '', false, true);
248
    } else {
249
//        // TODO Здесь надо писать в файло
250
      print("<hr>User ID {$user['id']} made log entry with code {$log_code} titled '{$title}' with text '{$message}' on page {$_SERVER['SCRIPT_NAME']}");
251
    }
252
  }
253
}
254
255
// Copyright (c) 2009-2010 Gorlum for http://supernova.ws
256
// Dump variables nicer then var_dump()
257
258
function dump($value, $varname = null, $level = 0, $dumper = '') {
259
  if(isset($varname)) {
260
    $varname .= " = ";
261
  }
262
263 View Code Duplication
  if($level == -1) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
264
    $trans[' '] = '&there4;';
0 ignored issues
show
Coding Style Comprehensibility introduced by
$trans was never initialized. Although not strictly required by PHP, it is generally a good practice to add $trans = array(); before regardless.

Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.

Let’s take a look at an example:

foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}

As you can see in this example, the array $myArray is initialized the first time when the foreach loop is entered. You can also see that the value of the bar key is only written conditionally; thus, its value might result from a previous iteration.

This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.

Loading history...
265
    $trans["\t"] = '&rArr;';
266
    $trans["\n"] = '&para;;';
267
    $trans["\r"] = '&lArr;';
268
    $trans["\0"] = '&oplus;';
269
270
    return strtr(htmlspecialchars($value), $trans);
271
  }
272
  if($level == 0) {
273
//    $dumper = '<pre>' . mt_rand(10, 99) . '|' . $varname;
0 ignored issues
show
Unused Code Comprehensibility introduced by
40% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
274
    $dumper = mt_rand(10, 99) . '|' . $varname;
275
  }
276
277
  $type = gettype($value);
278
  $dumper .= $type;
279
280 View Code Duplication
  if($type == 'string') {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
281
    $dumper .= '(' . strlen($value) . ')';
282
    $value = dump($value, '', -1);
283
  } elseif($type == 'boolean') {
284
    $value = ($value ? 'true' : 'false');
285
  } elseif($type == 'object') {
286
    $props = get_class_vars(get_class($value));
287
    $dumper .= '(' . count($props) . ') <u>' . get_class($value) . '</u>';
288
    foreach($props as $key => $val) {
289
      $dumper .= "\n" . str_repeat("\t", $level + 1) . $key . ' => ';
290
      $dumper .= dump($value->$key, '', $level + 1);
291
    }
292
    $value = '';
293
  } elseif($type == 'array') {
294
    $dumper .= '(' . count($value) . ')';
295
    foreach($value as $key => $val) {
296
      $dumper .= "\n" . str_repeat("\t", $level + 1) . dump($key, '', -1) . ' => ';
297
      $dumper .= dump($val, '', $level + 1);
298
    }
299
    $value = '';
300
  }
301
  $dumper .= " <b>$value</b>";
302
//  if($level == 0) {
0 ignored issues
show
Unused Code Comprehensibility introduced by
44% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
303
//    $dumper .= '</pre>';
304
//  }
305
306
  return $dumper;
307
}
308
309
function pdump($value, $varname = null) {
310
  $backtrace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);
311
//  print_rr($backtrace);
0 ignored issues
show
Unused Code Comprehensibility introduced by
59% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
312
//  $backtrace = $backtrace[1];
313
314
  $caller = '';
315
  if(defined('SN_DEBUG_PDUMP_CALLER') && SN_DEBUG_PDUMP_CALLER) {
316
    $caller = (!empty($backtrace[1]['class']) ? $backtrace[1]['class'] : '') .
317
      (!empty($backtrace[1]['type']) ? $backtrace[1]['type'] : '') .
318
      $backtrace[1]['function'] .
319
      (!empty($backtrace[0]['file'])
320
        ? (
321
          ' (' . substr($backtrace[0]['file'], SN_ROOT_PHYSICAL_STR_LEN) .
322
          (!empty($backtrace[0]['line']) ? ':' . $backtrace[0]['line'] : '') .
323
          ')'
324
        )
325
        : ''
326
      );
327
    $caller = "\r\n" . $caller;
328
  }
329
330
  print('<pre style="text-align: left; background-color: #111111; color: #0A0; font-family: Courier, monospace !important; padding: 1em 0; font-weight: 800; font-size: 14px;">' .
0 ignored issues
show
Security Cross-Site Scripting introduced by
'<pre style="text-align:...e) . $caller . '</pre>' can contain request data and is used in output context(s) leading to a potential security vulnerability.

5 paths for user data to reach this point

  1. Path: Read from $_GET, and $error_backtrace is assigned in classes/debug.php on line 165
  1. Read from $_GET, and $error_backtrace is assigned
    in classes/debug.php on line 165
  2. $error_backtrace is assigned
    in classes/debug.php on line 166
  3. $error_backtrace is assigned
    in classes/debug.php on line 167
  4. $error_backtrace is assigned
    in classes/debug.php on line 168
  5. $error_backtrace is assigned
    in classes/debug.php on line 169
  6. $error_backtrace is assigned
    in classes/debug.php on line 170
  7. $error_backtrace is assigned
    in classes/debug.php on line 172
  8. $error_backtrace is assigned
    in classes/debug.php on line 173
  9. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 202
  10. $name is assigned
    in classes/debug.php on line 222
  11. $name is passed to pdump()
    in classes/debug.php on line 224
  2. Path: Read from $_POST, and $error_backtrace is assigned in classes/debug.php on line 166
  1. Read from $_POST, and $error_backtrace is assigned
    in classes/debug.php on line 166
  2. $error_backtrace is assigned
    in classes/debug.php on line 167
  3. $error_backtrace is assigned
    in classes/debug.php on line 168
  4. $error_backtrace is assigned
    in classes/debug.php on line 169
  5. $error_backtrace is assigned
    in classes/debug.php on line 170
  6. $error_backtrace is assigned
    in classes/debug.php on line 172
  7. $error_backtrace is assigned
    in classes/debug.php on line 173
  8. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 202
  9. $name is assigned
    in classes/debug.php on line 222
  10. $name is passed to pdump()
    in classes/debug.php on line 224
  3. Path: Read from $_REQUEST, and $error_backtrace is assigned in classes/debug.php on line 167
  1. Read from $_REQUEST, and $error_backtrace is assigned
    in classes/debug.php on line 167
  2. $error_backtrace is assigned
    in classes/debug.php on line 168
  3. $error_backtrace is assigned
    in classes/debug.php on line 169
  4. $error_backtrace is assigned
    in classes/debug.php on line 170
  5. $error_backtrace is assigned
    in classes/debug.php on line 172
  6. $error_backtrace is assigned
    in classes/debug.php on line 173
  7. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 202
  8. $name is assigned
    in classes/debug.php on line 222
  9. $name is passed to pdump()
    in classes/debug.php on line 224
  4. Path: Read from $_COOKIE, and $error_backtrace is assigned in classes/debug.php on line 168
  1. Read from $_COOKIE, and $error_backtrace is assigned
    in classes/debug.php on line 168
  2. $error_backtrace is assigned
    in classes/debug.php on line 169
  3. $error_backtrace is assigned
    in classes/debug.php on line 170
  4. $error_backtrace is assigned
    in classes/debug.php on line 172
  5. $error_backtrace is assigned
    in classes/debug.php on line 173
  6. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 202
  7. $name is assigned
    in classes/debug.php on line 222
  8. $name is passed to pdump()
    in classes/debug.php on line 224
  5. Path: Read from $_SERVER, and $error_backtrace is assigned in classes/debug.php on line 170
  1. Read from $_SERVER, and $error_backtrace is assigned
    in classes/debug.php on line 170
  2. $error_backtrace is assigned
    in classes/debug.php on line 172
  3. $error_backtrace is assigned
    in classes/debug.php on line 173
  4. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 202
  5. $name is assigned
    in classes/debug.php on line 222
  6. $name is passed to pdump()
    in classes/debug.php on line 224

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
331
    dump($value, $varname) .
332
    $caller .
333
    '</pre>'
334
  );
335
}
336
337
function debug($value, $varname = null) {
338
  pdump($value, $varname);
339
}
340
341
function pr($prePrint = false) {
342
  if($prePrint) {
343
    print("<br>");
344
  }
345
  print(mt_rand() . "<br>");
346
}
347
348
function pc($prePrint = false) {
349
  global $_PRINT_COUNT_VALUE;
350
  $_PRINT_COUNT_VALUE++;
351
352
  if($prePrint) {
353
    print("<br>");
354
  }
355
  print($_PRINT_COUNT_VALUE . "<br>");
356
}
357
358
function prep($message) {
359
  print('<pre>' . $message . '</pre>');
360
}
361
362
function backtrace_no_arg() {
363
  $trace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);
364
  array_shift($trace);
365
  return $trace;
366
}