twistofreality /
dilmun
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Subreality\Dilmun\Enki; |
||
| 4 | |||
| 5 | use Subreality\Dilmun\LoggedClassTrait; |
||
| 6 | |||
| 7 | /** |
||
| 8 | * Class MySql |
||
| 9 | * @package Subreality\Dilmun\Enki |
||
| 10 | */ |
||
| 11 | class MySql implements EnkiInterface |
||
| 12 | { |
||
| 13 | use LoggedClassTrait; |
||
| 14 | |||
| 15 | /** |
||
| 16 | * @var \PDO |
||
| 17 | */ |
||
| 18 | private $pdo; |
||
| 19 | |||
| 20 | /** |
||
| 21 | * Provides a MySQL connection interface that catches a PDOException on failure. |
||
| 22 | * |
||
| 23 | * @param string $host The host name for the MySQL connection |
||
| 24 | * @param string $user The username for the MySQL connection |
||
| 25 | * @param string $pass The password for the MySQL connection |
||
| 26 | * @param string $name The database name for the MySQL connection |
||
| 27 | * |
||
| 28 | * @return bool Returns true if the connection was successful; returns false otherwise |
||
| 29 | */ |
||
| 30 | 13 | public function connect($host, $user, $pass, $name) |
|
| 31 | { |
||
| 32 | 13 | $dsn = "mysql:host={$host};dbname={$name}"; |
|
| 33 | |||
| 34 | try { |
||
| 35 | 13 | $this->pdo = new \PDO($dsn, $user, $pass); |
|
| 36 | 12 | $this->pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION); |
|
| 37 | |||
| 38 | 12 | $connected = true; |
|
| 39 | 13 | } catch (\PDOException $pdo_e) { |
|
| 40 | 1 | $context = array(); |
|
| 41 | |||
| 42 | 1 | $context["exception"] = $pdo_e; |
|
| 43 | |||
| 44 | 1 | $this->updateLog("error", "MySQL connection failed with the following message: {message}", $context); |
|
| 45 | |||
| 46 | 1 | $connected = false; |
|
| 47 | } |
||
| 48 | |||
| 49 | 13 | return $connected; |
|
| 50 | } |
||
| 51 | |||
| 52 | /** |
||
| 53 | * Destroys an existing PDO connection |
||
| 54 | * |
||
| 55 | * @return bool Returns true if the connection existed and was destroyed; returns false otherwise |
||
| 56 | */ |
||
| 57 | 2 | public function disconnect() |
|
| 58 | { |
||
| 59 | 2 | if ($this->pdo instanceof \PDO) { |
|
| 60 | 1 | $this->pdo = null; |
|
| 61 | |||
| 62 | 1 | $disconnected = true; |
|
| 63 | 1 | } else { |
|
| 64 | 1 | $disconnected = false; |
|
| 65 | } |
||
| 66 | |||
| 67 | 2 | return $disconnected; |
|
| 68 | } |
||
| 69 | |||
| 70 | /** |
||
| 71 | * Gets the column names for all primary keys for a table or returns false if no keys exist |
||
| 72 | * |
||
| 73 | * @param string $table The table from which keys will be retrieved |
||
| 74 | * |
||
| 75 | * @return string|false Returns a string of column names representing primary keys; |
||
| 76 | * returns false if the table has no primary keys |
||
| 77 | */ |
||
| 78 | 8 | public function getPrimaryKeys($table) |
|
| 79 | { |
||
| 80 | 8 | $keys_query = "SHOW KEYS FROM {$table} WHERE Key_name='PRIMARY'"; |
|
| 81 | |||
| 82 | 8 | $statement = $this->pdo->prepare($keys_query); |
|
| 83 | |||
| 84 | 8 | $result = $this->statementWrapper($statement, "Trying to get keys failed with the following message: "); |
|
| 85 | |||
| 86 | 8 | if ($result) { |
|
| 87 | 5 | $keys = $this->processPrimaryKeyResult($result); |
|
| 88 | 5 | } else { |
|
| 89 | 3 | $keys = false; |
|
| 90 | } |
||
| 91 | |||
| 92 | 8 | return $keys; |
|
| 93 | } |
||
| 94 | |||
| 95 | /** |
||
| 96 | * Retrieves a row represented by a single primary key |
||
| 97 | * |
||
| 98 | * @param int|string $id A unique id for a table |
||
| 99 | * @param string $table The table from which a row will be retrieved |
||
| 100 | * |
||
| 101 | * @return array|false Returns an associative array representing the row corresponding with the primary key; |
||
| 102 | * returns false if the table does not exist, if the provided id does not correspond with a |
||
| 103 | * record, or if the table has a compound primary key |
||
| 104 | */ |
||
| 105 | 5 | public function getRowById($id, $table) |
|
| 106 | { |
||
| 107 | 5 | $id = $this->quoteQueryStringVariable($id); |
|
| 108 | 5 | $key = $this->getPrimaryKeys($table); |
|
| 109 | |||
| 110 | 5 | $query = "SELECT * FROM {$table} |
|
| 111 | 5 | WHERE {$key} = {$id}"; |
|
| 112 | |||
| 113 | 5 | $statement = $this->pdo->prepare($query); |
|
| 114 | |||
| 115 | 5 | $result = $this->statementWrapper($statement); |
|
| 116 | |||
| 117 | 5 | if (empty($result)) { |
|
| 118 | 3 | $row = false; |
|
| 119 | 3 | } else { |
|
| 120 | 2 | $row = $result[0]; |
|
| 121 | } |
||
| 122 | |||
| 123 | 5 | return $row; |
|
| 124 | } |
||
| 125 | |||
| 126 | /** |
||
| 127 | * Determines whether a given table exists |
||
| 128 | * |
||
| 129 | * @param string $table The table that will be checked for existence |
||
| 130 | * @return bool Returns true if the table exists; returns false otherwise |
||
| 131 | */ |
||
| 132 | 2 | public function tableExists($table) |
|
| 133 | { |
||
| 134 | 2 | $table_query = "SHOW TABLES LIKE '{$table}'"; |
|
| 135 | |||
| 136 | 2 | $statement = $this->pdo->prepare($table_query); |
|
| 137 | |||
| 138 | 2 | $statement->execute(); |
|
| 139 | |||
| 140 | 2 | $row_count = $statement->rowCount(); |
|
| 141 | |||
| 142 | 2 | if ($row_count == 0) { |
|
|
0 ignored issues
–
show
Coding Style
introduced
by
Loading history...
|
|||
| 143 | 1 | return false; |
|
| 144 | } else { |
||
| 145 | 1 | return true; |
|
| 146 | } |
||
| 147 | } |
||
| 148 | |||
| 149 | /** |
||
| 150 | * Processes the result set from a primary key query |
||
| 151 | * |
||
| 152 | * @see MySql::getPrimaryKeys() |
||
| 153 | * |
||
| 154 | * @param array $result An array representing the result of a primary key query |
||
| 155 | * |
||
| 156 | * @return string|false Returns a string column name if the result set contains only one primary key; |
||
| 157 | * returns false otherwise |
||
| 158 | */ |
||
| 159 | 5 | private function processPrimaryKeyResult($result) |
|
| 160 | { |
||
| 161 | 5 | $row_count = count($result); |
|
| 162 | 5 | $this->updateLog("debug", "{$row_count} keys found"); |
|
| 163 | |||
| 164 | 5 | if ($row_count == 1) { |
|
| 165 | 4 | $this->updateLog("debug", "Single key found; setting up key string"); |
|
| 166 | |||
| 167 | 4 | $keys = $result[0]['Column_name']; |
|
| 168 | 4 | } else { |
|
| 169 | 1 | $this->updateLog("debug", "No key or multiple keys found; returning false"); |
|
| 170 | |||
| 171 | 1 | $keys = false; |
|
| 172 | } |
||
| 173 | |||
| 174 | 5 | return $keys; |
|
| 175 | } |
||
| 176 | |||
| 177 | /** |
||
| 178 | * Prepares a variable for a query string by surrounding it with single quotes if it's a string |
||
| 179 | * |
||
| 180 | * @param mixed $var The variable to be assessed for quoting |
||
| 181 | * |
||
| 182 | * @return mixed Returns the single-quoted variable if the variable is a string; returns the variable |
||
| 183 | * otherwise |
||
| 184 | */ |
||
| 185 | 5 | private function quoteQueryStringVariable($var) |
|
| 186 | { |
||
| 187 | 5 | if (is_string($var)) { |
|
| 188 | 1 | $query_var = "'{$var}'"; |
|
| 189 | 1 | } else { |
|
| 190 | 4 | $query_var = $var; |
|
| 191 | } |
||
| 192 | |||
| 193 | 5 | return $query_var; |
|
| 194 | } |
||
| 195 | |||
| 196 | /** |
||
| 197 | * A wrapper for executing PDOStatement objects that either returns the statement execution result or |
||
| 198 | * catches any PDOException thrown and updates the class logger with the exception message. |
||
| 199 | * |
||
| 200 | * @param \PDOStatement $statement The statement to be executed |
||
| 201 | * @param string|null $log_message OPTIONAL: The message to be logged, in addition to the PDOException message |
||
| 202 | * |
||
| 203 | * @return array|false Returns an associative array of the statement execution result of execution |
||
| 204 | * was successful; returns false otherwise |
||
| 205 | */ |
||
| 206 | 8 | private function statementWrapper(\PDOStatement $statement, $log_message = null) |
|
| 207 | { |
||
| 208 | 8 | if ($log_message === null) { |
|
| 209 | 5 | $log_message = "Statement execution error: "; |
|
| 210 | 5 | } |
|
| 211 | |||
| 212 | try { |
||
| 213 | 8 | $statement->execute(); |
|
| 214 | 8 | } catch (\PDOException $pdo_e) { |
|
| 215 | 3 | $context = array(); |
|
| 216 | |||
| 217 | 3 | $context["exception"] = $pdo_e; |
|
| 218 | |||
| 219 | 3 | $this->updateLog("error", "{$log_message}: {message}", $context); |
|
| 220 | |||
| 221 | 3 | return false; |
|
| 222 | } |
||
| 223 | |||
| 224 | 7 | $result = $statement->fetchAll(\PDO::FETCH_ASSOC); |
|
| 225 | |||
| 226 | 7 | return $result; |
|
| 227 | } |
||
| 228 | } |
||
| 229 |