File Source for db_connection.class.php

<?php
// *** Tangra (Application Framework and Tools for PHP)
// $Id$
//
/**
* Contains DB_Connection class
*
* @package tangra_lib
* @subpackage db
*/
/**
* Requires parent class
*/
require_once(TANGRA_MAIN_DIR.'core/tangra_class.class.php');
/**
* Base class for DB_Connection class family.
*
* DB_Connection class contains connection to DB and methods to query that DB.
*
* @package tangra_lib
* @subpackage db
*/
abstract class DB_Connection extends Tangra_Class {
/**
* Is connected to DB?
*
* @var boolean
*/
private $connected = false;
/**
* DB DSN
*
* @var string
*/
private $dsn;
/**
* DB connection itself (resource)
*
* @var unknown_type
*/
protected $conn;
/**
* Autocommit mode
*
* @var integer
*/
private $autocommit;
/**
* Constructor
*
* Attempts to connect to database specified with {@link dsn}
*
* @param string $dsn Valid DSN
* @return boolean returns true on success, flase otherwise
*/
function __construct($dsn) {
$this->dsn = $dsn;
$ret = $this->connect();
return $ret;
}
/**
* Tries to connect to DB
*
*/
abstract public function connect();
/**
* Disconnects from the DB
*
*/
abstract public function disconnect();
/**
* Sets $this->connected
*
* @param boolean $connected
* @access private
*/
final protected function set_connected($connected) {
$this->connected = $connected;
}
/**
* Gets $this->connected
*
* @return boolean
*/
final public function is_connected() {
return $this->connected;
}
/**
* Gets DB DSN
*
* @return unknown
*/
final public function get_dsn() {
return $this->dsn;
}
/**
* Starting transaction
*
*/
abstract public function start_trans();
/**
* Finishing transaction
*
*/
abstract public function complete_trans();
/**
* Manually marking transaction as failed
*
*/
abstract public function fail_trans();
/**
* Executes SQL statemnt
*
* @param string $sql
*/
abstract public function execute($sql, $ignore_sql_injection_warning = false);
/**
* Selects limited ammount of rows
*
* Useful for paginating the results.
*
* @param string $sql SQL statement
* @param integer $num_rows number of rows to select
* @param integer $offset offset to start
*/
abstract public function select_limit($sql, $num_rows, $offset);
/**
* Alias of {@link execute()}
*
* @param string $sql
*/
abstract public function query($sql);
/**
* Generates next id from sequence
*
* For RDBMS that does not support sequences this have to be emulated by DB abstraction layer
*
* @param string $table_id_is_for name of the sequence
* @param unknown_type $start if sequence is not existing $start will be used as initial value when sequence is automatically created
*/
abstract public function generate_id($sequence_name, $start = 1);
/**
* Returns error message if any
*
*/
abstract public function get_error_msg();
/**
* Destructor
*
* Here is the place to disconnect nicely from the database
*
*/
abstract function __destruct();
/**
* Sets autocommit mode
*
* @param unknown_type $auto
*/
public function set_autocommit($auto) {
$this->autocommit = $auto ? 1 : 0;
}
/**
* Gets autocommit mode
*
* @return unknown
*/
public function get_autocommit() {
return $this->autocommit;
}
/**
* Executes sql statemnt(s) in transaction
*
* @param DB_Connection $dbc
* @param mixed $sql
*/
public static function execute_in_trans(DB_Connection $dbc, $sql) {
$dbc->start_trans();
try {
if (is_array($sql)) {
foreach($sql as $statement) {
$dbc->execute($statement);
}
} else {
$dbc->execute($sql);
}
$dbc->complete_trans();
} catch (Exception $e) {
$dbc->fail_trans();
$dbc->complete_trans();
throw $e;
}
}
/**
* Returns internal db connection object
*
* This function should be used only if you REALLY need to use DBAL (ADODB, PDO, etc...) specific calls.
*
* @return unknown
*/
public function get_conn() {
return $this->conn;
}
/**
* Checks if $sql looks like SQL injection attempt
*
* This function will check if there are comments in the $sql and if found will return true.
* Don't overtrust this to keep you safe - allways check and escape data before sending it as SQL statement to the RDBMS.
* Please note that by default queries that use UNION are detected as sql inj attempt. Use $ignore_sql_injection_warning = true or comment this check bellow in the method body
*
* @param string $sql
* @return boolean Returns true if $sql is suspicious
*/
protected function is_like_sql_injection($sql) {
$ret = false;
$sql = strtolower($this->remove_quoted($sql));
if (strpos($sql, ';') !== false) { // multiple queries forbidden
$ret = true;
}
// comments forbidden
if (strpos($sql, ' --') !== false) {
$ret = true;
}
if (strpos($sql, "\t--") !== false) {
$ret = true;
}
if (strpos($sql, "\n--") !== false) {
$ret = true;
}
if (strpos($sql, ' /*') !== false) {
$ret = true;
}
// If you use UNION you will have to either comment next 3 lines, or execute queries with $ignore_sql_injection_warning flag = true
if (strpos($sql, ' union ') !== false) {
$ret = true;
}
return $ret;
}
/**
* Removes quoted content from $sql_str
*
* @param string $sql_str
* @return string
* @internal
*/
private function remove_quoted($sql_str) {
$sql_str = str_replace("\\", '', $sql_str);
$sql_str = str_replace("\'", '', $sql_str);
$sql_str = str_replace("\`", '', $sql_str);
$sql_str = str_replace('\"', '', $sql_str);
while (strpos($sql_str, "'") !== false) {
$sql_str = $this->_remove_quoted_with($sql_str, "'");
}
while (strpos($sql_str, '"') !== false) {
$sql_str = $this->_remove_quoted_with($sql_str, '"');
}
return $sql_str;
}
/**
* Removes quoted with $q from $sql_str
*
* @param string $sql_str
* @param string $q One character ' or "
* @return string
*/
private function _remove_quoted_with($sql_str, $q) {
$start = strpos($sql_str, $q);
if ($start !== false) {
$end = strpos($sql_str, $q, $start);
if ($end !== false) {
$tmp1 = substr($sql_str, 0, $start);
$tmp2 = substr($sql_str, $end);
$sql_str = $tmp1.$tmp1;
} else {
$sql_str = substr($sql_str, 0, $start);
}
}
return $sql_str;
}
}

Source for file db_connection.class.php