[Cs-content-commits] SF.net SVN: cs-content:[413] trunk/1.0
PHP Templating & Includes System
Brought to you by:
crazedsanity
From: <cra...@us...> - 2009-08-03 17:41:27
|
Revision: 413 http://cs-content.svn.sourceforge.net/cs-content/?rev=413&view=rev Author: crazedsanity Date: 2009-08-03 17:41:13 +0000 (Mon, 03 Aug 2009) Log Message: ----------- Tests strictly for cs_globalFunctions. /cs_globalFunctions.class.php: * string_from_array(): -- removed unused $typesArr -- [update]: + clean only if it does not both start AND end in single quotes + if the entire value is one single quote, delimit it and wrap in single quotes. + empty values get an empty string value ('') -- [select]: + pass forceSqlQuotes to cleanString() + wrap in quotes if there's a separator, regardless of whether or not the value is numeric (the DB should be able to convert a text number into an actual number). * interpret_bool(): -- when a decimal number is passed, drop the decimal so it is handled as a whole number; otherwise, 0.1 is treated as though it were 0 (due to the settype() as integer call). /tests/testOfCSContent.php: * Dropped methods (moved to testOfCSGlobalFunctions.php): -- test_cleanString() -- test_string_from_array() -- test_interpret_bool() /tests/testOfCSGlobalFunctions.php [NEW]: * copied from testOfCSContent.php, with expanded tests. Modified Paths: -------------- trunk/1.0/cs_globalFunctions.class.php trunk/1.0/tests/testOfCSContent.php Added Paths: ----------- trunk/1.0/tests/testOfCSGlobalFunctions.php Modified: trunk/1.0/cs_globalFunctions.class.php =================================================================== --- trunk/1.0/cs_globalFunctions.class.php 2009-07-29 19:03:37 UTC (rev 412) +++ trunk/1.0/cs_globalFunctions.class.php 2009-08-03 17:41:13 UTC (rev 413) @@ -162,7 +162,6 @@ } //make sure $style is valid. - $typesArr = array("insert", "update"); $style = strtolower($style); if(is_array($array)) { @@ -222,10 +221,17 @@ if(($value === "NULL" || $value === NULL) && !$this->forceSqlQuotes) { $sqlQuotes = 0; } - if($cleanString && !preg_match('/^\'/',$value)) { + if($cleanString && !(preg_match('/^\'/',$value) && preg_match('/\'$/', $value))) { //make sure it doesn't have crap in it... $value = $this->cleanString($value, "sql",$sqlQuotes); } + if($value == "'") { + //Fix possible SQL-injection. + $value = "'\''"; + } + elseif(!strlen($value)) { + $value = "''"; + } $retval = $this->create_list($retval, $field . $separator . $value); } break; @@ -277,9 +283,9 @@ } if($cleanString) { //make sure it doesn't have crap in it... - $value = $this->cleanString($value, "sql"); + $value = $this->cleanString($value, "sql", $this->forceSqlQuotes); } - if(!is_numeric($value) && isset($separator)) { + if(isset($separator)) { $value = "'". $value ."'"; } $retval = $this->create_list($retval, $field . $separator . $value, " $delimiter "); @@ -804,8 +810,12 @@ //now figure out the value to return. if(is_numeric($interpretThis)) { + if(preg_match('/\.[0-9]{1,}/', $interpretThis)) { + //if it is a decimal number, remove the dot (i.e. "0.000001" -> "0000001" -> 1) + $interpretThis = str_replace('.', '', $interpretThis); + } settype($interpretThis, 'integer'); - if($interpretThis == '0') { + if($interpretThis == 0) { $index=0; } else { Modified: trunk/1.0/tests/testOfCSContent.php =================================================================== --- trunk/1.0/tests/testOfCSContent.php 2009-07-29 19:03:37 UTC (rev 412) +++ trunk/1.0/tests/testOfCSContent.php 2009-08-03 17:41:13 UTC (rev 413) @@ -33,154 +33,6 @@ //------------------------------------------------------------------------- - public function test_cleanString() { - - $gf = new cs_globalFunctions(); - - $cleanThis = '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS'; - $testSQL = array( - 'none' => $cleanThis, - 'query' => '@_=;34:/JuST THIS', - 'theDefault' => '34JuSTTHIS', - 'alphanumeric' => '34JuSTTHIS', - 'sql' => '~`!@#$^&*()_+-=[]{}|;34:\\\'<>?,.//\".JuST THIS', - 'sql_insert' => '~`!@#$^&*()_+-=[]{}|;34:\\\\\'<>?,.//".JuST THIS', - 'sql92_insert' => '~`!@#$^&*()_+-=[]{}|;34:\'\'<>?,.//".JuST THIS', - 'double_quote' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\.JuST THIS', - 'htmlspecial' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', - 'htmlspecial_q' => '~`!@#$^&*()_+-=[]\{}|;34:\\'\<>?,.//\".JuST THIS', - 'htmlspecial_nq' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', - 'htmlentity' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', - 'htmlentity_plus_brackets' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', - 'double_entity' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\.JuST THIS', - 'meta' => '~`!@#\$\^&\*\(\)_\+-=\[\]\\\\{}|;34:\\\\\'\\\<>\?,\.//\\\\"\.JuST THIS', - 'email' => '@_-34..JuSTTHIS', - 'email_plus_spaces' => '@_-34..JuST THIS', - 'phone_fax' => '()+-34 ', - 'integer' => '34', - 'numeric' => '34', - 'decimal' => '34..', - 'float' => '34..', - 'name' => '\'JuSTTHIS', - 'names' => '\'JuSTTHIS', - 'alpha' => 'JuSTTHIS', - 'bool' => 't', - 'varchar' => '\'@_=;34:/JuST THIS\'', - 'date' => '-34', - 'datetime' => '-34:\'.//.JuST THIS', - 'all' => '34JuSTTHIS' - ); - - foreach($testSQL as $name=>$expected) { - $cleanedData = $gf->cleanString($cleanThis, $name); - - //NOTE::: passing "%" in the message data causes an exception with the simpletest framework. - $this->assertEqual($expected, $cleanedData); - } - - - //test quoting (with a few exceptions). - $testQuotes = $testSQL; - unset($testQuotes['none'], $testQuotes['sql92_insert']); - foreach($testQuotes as $name=>$expected) { - $gf->switch_force_sql_quotes(1); - $cleanedDataPlusQuotes = $gf->cleanString($cleanThis, $name, 1); - $this->assertEqual("'". $expected ."'", $cleanedDataPlusQuotes, "Failed quoting with style=(". $name .")"); - - $gf->switch_force_sql_quotes(0); - $this->assertEqual("'". $expected ."'", $cleanedDataPlusQuotes, "Failed quoting with style=(". $name .")"); - } - - - //TEST NULLS - { - - $this->assertEqual($gf->cleanString("", "numeric",0), ""); - $this->assertEqual($gf->cleanString("", "numeric",1), "''"); - $this->assertEqual($gf->cleanString("", "integer",0), ""); - $this->assertEqual($gf->cleanString("", "integer",1), "''"); - $this->assertEqual($gf->cleanString(null, "numeric",0), "NULL"); - $this->assertEqual($gf->cleanString(null, "numeric",1), "NULL"); - $this->assertEqual($gf->cleanString(null, "integer",0), "NULL"); - $this->assertEqual($gf->cleanString(null, "integer",1), "NULL"); - - $this->assertEqual($gf->cleanString(null, "varchar",0), "NULL"); - $this->assertEqual($gf->cleanString(null, "varchar",1), "'NULL'"); - $this->assertEqual($gf->cleanString("", "varchar",0), "NULL"); - $this->assertEqual($gf->cleanString("", "varchar",1), "'NULL'"); - } - - }//end test_cleanString() - //------------------------------------------------------------------------- - - - - //------------------------------------------------------------------------- - function test_string_from_array() { - $gf = new cs_globalFunctions; - $gf->switch_force_sql_quotes(0); - - //Test some SQL-Specific stuff. - $testSQL = array( - 'column1' => "'my value ' OR 'x'='x'", - 'column two' => "Stuff" - ); - - //Test INSERT style. - { - $expected = "(column1, column two) VALUES ('my value ' OR 'x'='x','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert'), $expected); - - $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql'), $expected); - - $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql_insert'), $expected); - - $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql92_insert'), $expected); - - //now let's see what happens if we pass an array signifying how it should be cleaned. - $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql', 'column two'=>'sql')), $expected); - $expected = "(column1, column two) VALUES ('\\\\\'my value \\\\\' OR \\\\\'x\\\\\'=\\\\\'x\\\\\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql_insert', 'column two'=>'sql_insert')), $expected); - $expected = "(column1, column two) VALUES ('\'\'my value \'\' OR \'\'x\'\'=\'\'x\'\'','Stuff')"; - $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql92_insert', 'column two'=>'sql92_insert')), $expected); - - } - - }//end test_string_from_array() - //------------------------------------------------------------------------- - - - - //------------------------------------------------------------------------- - function test_interpret_bool() { - $gf=new cs_globalFunctions; - - $this->assertEqual($gf->interpret_bool('true'), true); - $this->assertEqual($gf->interpret_bool('false'), false); - $this->assertEqual($gf->interpret_bool('0'), false); - $this->assertEqual($gf->interpret_bool('1'), true); - $this->assertEqual($gf->interpret_bool(0), false); - $this->assertEqual($gf->interpret_bool(1), true); - $this->assertEqual($gf->interpret_bool('f'), false); - $this->assertEqual($gf->interpret_bool('t'), true); - $this->assertEqual($gf->interpret_bool("1stuff"), true); - $this->assertEqual($gf->interpret_bool(""), false); - $this->assertEqual($gf->interpret_bool(" true "), true); - $this->assertEqual($gf->interpret_bool(" false "), false); - - //now go through the same thing, but this time tell it to give back a specific value for true and false. - $this->assertEqual($gf->interpret_bool(false, array(0=>'FaLSe',1=>"crap")), 'FaLSe'); - $this->assertEqual($gf->interpret_bool(false, array(0=>"crap",1=>'FaLSe')), 'crap'); - }//end test_interpret_bool() - //------------------------------------------------------------------------- - - - - //------------------------------------------------------------------------- public function test_siteConfig() { $configFile = constant('TEST_FILESDIR') .'/sampleConfig.xml'; $varPrefix = preg_replace("/:/", "_", __METHOD__ ."-"); Copied: trunk/1.0/tests/testOfCSGlobalFunctions.php (from rev 412, trunk/1.0/tests/testOfCSContent.php) =================================================================== --- trunk/1.0/tests/testOfCSGlobalFunctions.php (rev 0) +++ trunk/1.0/tests/testOfCSGlobalFunctions.php 2009-08-03 17:41:13 UTC (rev 413) @@ -0,0 +1,249 @@ +<?php +/* + * Created on Jan 13, 2009 + * + * + * FILE INFORMATION: + * + * $HeadURL$ + * $Id$ + * $LastChangedDate$ + * $LastChangedBy$ + * $LastChangedRevision$ + */ + + + +//============================================================================= +class TestOfCSGlobalFunctions extends UnitTestCase { + + //------------------------------------------------------------------------- + function __construct() { + require_once(dirname(__FILE__) .'/../cs_globalFunctions.class.php'); + require_once(dirname(__FILE__) .'/../cs_siteConfig.class.php'); + + $this->gfObj = new cs_globalFunctions; + $this->gfObj->debugPrintOpt=1; + + $filesDir = dirname(__FILE__) ."/files"; + define('TEST_FILESDIR', $filesDir); + }//end __construct() + //------------------------------------------------------------------------- + + + + //------------------------------------------------------------------------- + public function test_cleanString() { + + $gf = new cs_globalFunctions(); + + $cleanThis = '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS'; + $testSQL = array( + 'none' => $cleanThis, + 'query' => '@_=;34:/JuST THIS', + 'theDefault' => '34JuSTTHIS', + 'alphanumeric' => '34JuSTTHIS', + 'sql' => '~`!@#$^&*()_+-=[]{}|;34:\\\'<>?,.//\".JuST THIS', + 'sql_insert' => '~`!@#$^&*()_+-=[]{}|;34:\\\\\'<>?,.//".JuST THIS', + 'sql92_insert' => '~`!@#$^&*()_+-=[]{}|;34:\'\'<>?,.//".JuST THIS', + 'double_quote' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\.JuST THIS', + 'htmlspecial' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', + 'htmlspecial_q' => '~`!@#$^&*()_+-=[]\{}|;34:\\'\<>?,.//\".JuST THIS', + 'htmlspecial_nq' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', + 'htmlentity' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', + 'htmlentity_plus_brackets' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\".JuST THIS', + 'double_entity' => '~`!@#$^&*()_+-=[]\{}|;34:\\\'\<>?,.//\.JuST THIS', + 'meta' => '~`!@#\$\^&\*\(\)_\+-=\[\]\\\\{}|;34:\\\\\'\\\<>\?,\.//\\\\"\.JuST THIS', + 'email' => '@_-34..JuSTTHIS', + 'email_plus_spaces' => '@_-34..JuST THIS', + 'phone_fax' => '()+-34 ', + 'integer' => '34', + 'numeric' => '34', + 'decimal' => '34..', + 'float' => '34..', + 'name' => '\'JuSTTHIS', + 'names' => '\'JuSTTHIS', + 'alpha' => 'JuSTTHIS', + 'bool' => 't', + 'varchar' => '\'@_=;34:/JuST THIS\'', + 'date' => '-34', + 'datetime' => '-34:\'.//.JuST THIS', + 'all' => '34JuSTTHIS' + ); + + foreach($testSQL as $name=>$expected) { + $cleanedData = $gf->cleanString($cleanThis, $name); + + //NOTE::: passing "%" in the message data causes an exception with the simpletest framework. + $this->assertEqual($expected, $cleanedData); + } + + + //test quoting (with a few exceptions). + $testQuotes = $testSQL; + unset($testQuotes['none'], $testQuotes['sql92_insert']); + foreach($testQuotes as $name=>$expected) { + $gf->switch_force_sql_quotes(1); + $cleanedDataPlusQuotes = $gf->cleanString($cleanThis, $name, 1); + $this->assertEqual("'". $expected ."'", $cleanedDataPlusQuotes, "Failed quoting with style=(". $name .")"); + + $gf->switch_force_sql_quotes(0); + $this->assertEqual("'". $expected ."'", $cleanedDataPlusQuotes, "Failed quoting with style=(". $name .")"); + } + + + //TEST NULLS + { + + $this->assertEqual($gf->cleanString("", "numeric",0), ""); + $this->assertEqual($gf->cleanString("", "numeric",1), "''"); + $this->assertEqual($gf->cleanString("", "integer",0), ""); + $this->assertEqual($gf->cleanString("", "integer",1), "''"); + $this->assertEqual($gf->cleanString(null, "numeric",0), "NULL"); + $this->assertEqual($gf->cleanString(null, "numeric",1), "NULL"); + $this->assertEqual($gf->cleanString(null, "integer",0), "NULL"); + $this->assertEqual($gf->cleanString(null, "integer",1), "NULL"); + + $this->assertEqual($gf->cleanString(null, "varchar",0), "NULL"); + $this->assertEqual($gf->cleanString(null, "varchar",1), "'NULL'"); + $this->assertEqual($gf->cleanString("", "varchar",0), "NULL"); + $this->assertEqual($gf->cleanString("", "varchar",1), "'NULL'"); + } + + }//end test_cleanString() + //------------------------------------------------------------------------- + + + + //------------------------------------------------------------------------- + function test_string_from_array() { + $gf = new cs_globalFunctions; + $gf->switch_force_sql_quotes(0); + + //Test some SQL-Specific stuff. + $testSQL = array( + 'column1' => "'my value ' OR 'x'='x'", + 'column two' => "Stuff" + ); + + //Test INSERT style. + { + $expected = "(column1, column two) VALUES ('my value ' OR 'x'='x','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert'), $expected); + + $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql'), $expected); + + $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql_insert'), $expected); + + $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, 'sql92_insert'), $expected); + + //now let's see what happens if we pass an array signifying how it should be cleaned. + $expected = "(column1, column two) VALUES ('\'my value \' OR \'x\'=\'x\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql', 'column two'=>'sql')), $expected); + $expected = "(column1, column two) VALUES ('\\\\\'my value \\\\\' OR \\\\\'x\\\\\'=\\\\\'x\\\\\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql_insert', 'column two'=>'sql_insert')), $expected); + $expected = "(column1, column two) VALUES ('\'\'my value \'\' OR \'\'x\'\'=\'\'x\'\'','Stuff')"; + $this->assertEqual($gf->string_from_array($testSQL, 'insert', null, array('column1'=>'sql92_insert', 'column two'=>'sql92_insert')), $expected); + + } + + //make sure forceSqlQuotes is OFF. + $gf->switch_force_sql_quotes(0); + + //Test the SELECT style. + { + //a basic set of criteria... + $expected = "w='' AND x='y' AND y='0' AND z=''"; + $actual = $gf->string_from_array(array('w'=>'', 'x'=>"y", 'y'=>0,'z'=>NULL), 'select'); + $this->assertEqual($expected, $actual); + + //make sure it distinguishes between text "NULL" and literal NULL. + $expected = "w='' AND x='y' AND y='0' AND z='NULL'"; + $actual = $gf->string_from_array(array('w'=>'', 'x'=>"y", 'y'=>0,'z'=>"NULL"), 'select'); + $this->assertEqual($expected, $actual); + + //make sure it distinguishes between text "NULL" and literal NULL. + $expected = "w='' AND x='y' AND y='0' AND z='NULL'"; + $actual = $gf->string_from_array(array('w'=>'', 'x'=>"y", 'y'=>0,'z'=>"NULL"), 'select', null, 'sql'); + $this->assertEqual($expected, $actual); + + //check with specific cleaning styles. + $expected = "w='' AND x='y' AND y='0' AND z='NULL'"; + $cleanString = array('w'=>"nonexistent", 'x'=>"alpha", 'y'=>"numeric", 'z'=>"sql"); + $actual = $gf->string_from_array(array('w'=>'', 'x'=>"y", 'y'=>0,'z'=>"NULL"), 'select', null, $cleanString); + $this->assertEqual($expected, $actual); + } + + + //Test the UPDATE style. + { + //basic update. + $expected = "w='', x='y', y='0', z=''"; + $actual = $gf->string_from_array(array('w'=>"", 'x'=>"y", 'y'=>0, 'z'=>NULL), 'update', null, 'sql'); + $this->assertEqual($expected, $actual); + + + //basic update, but force SQL quotes... + $gf->switch_force_sql_quotes(1); + $expected = "w='', x='y', y='0', z=''"; + $actual = $gf->string_from_array(array('w'=>"", 'x'=>"y", 'y'=>0, 'z'=>NULL), 'update', null, 'sql'); + $this->assertEqual($expected, $actual); + $gf->switch_force_sql_quotes(0); + + //update with invalid quotes (attempts at SQL injection) + $expected = "w='\' ', x='\'', y='0', z=''"; + $actual = $gf->string_from_array(array('w'=>"' ", 'x'=>"'", 'y'=>0, 'z'=>NULL), 'update', null, 'sql'); + $this->assertEqual($expected, $actual); + } + + + }//end test_string_from_array() + //------------------------------------------------------------------------- + + + + //------------------------------------------------------------------------- + function test_interpret_bool() { + $gf=new cs_globalFunctions; + + $this->assertEqual($gf->interpret_bool('true'), true); + $this->assertEqual($gf->interpret_bool(true), true); + $this->assertEqual($gf->interpret_bool('false'), false); + $this->assertEqual($gf->interpret_bool(false), false); + $this->assertEqual($gf->interpret_bool('0'), false); + $this->assertEqual($gf->interpret_bool('1'), true); + $this->assertEqual($gf->interpret_bool(0), false); + $this->assertEqual($gf->interpret_bool(000000), false); + $this->assertEqual($gf->interpret_bool(1), true); + $this->assertEqual($gf->interpret_bool(0.1), true); + $this->assertEqual($gf->interpret_bool(0.01), true); + $this->assertEqual($gf->interpret_bool(0.001), true); + $this->assertEqual($gf->interpret_bool('f'), false); + $this->assertEqual($gf->interpret_bool('fa'), true); + $this->assertEqual($gf->interpret_bool('fal'), true); + $this->assertEqual($gf->interpret_bool('fals'), true); + $this->assertEqual($gf->interpret_bool('t'), true); + $this->assertEqual($gf->interpret_bool('tr'), true); + $this->assertEqual($gf->interpret_bool('tru'), true); + $this->assertEqual($gf->interpret_bool("1stuff"), true); + $this->assertEqual($gf->interpret_bool(""), false); + $this->assertEqual($gf->interpret_bool(" true "), true); + $this->assertEqual($gf->interpret_bool(" false "), false); + $this->assertEqual($gf->interpret_bool('false-showastrue'), true); + $this->assertEqual($gf->interpret_bool('true-showastrue'), true); + + + //now go through the same thing, but this time tell it to give back a specific value for true and false. + $this->assertEqual($gf->interpret_bool(false, array(0=>'FaLSe',1=>"crap")), 'FaLSe'); + $this->assertEqual($gf->interpret_bool(false, array(0=>"crap",1=>'FaLSe')), 'crap'); + }//end test_interpret_bool() + //------------------------------------------------------------------------- + + + +}//end TestOfCSContent +//============================================================================= +?> This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |