search.php | searchcode

/search.php

https://github.com/jwheare/FITB · PHP · 83 lines · 73 code · 10 blank · 0 comment · 19 complexity · 817fbd96aef91b7b113eed6a44a5bca9 MD5 · raw file


<?php
include_once('functions.php');
$searchquery = $_GET['query'];

$start = "";
if(isset($_GET['duration'])) {
    $start = "&duration=" . $_GET['duration'];
}
if((isset($_GET['type'])) && ($_GET['type'] != "")) {
    $type = $_GET['type'];
}

if((isset($_GET['host'])) && ($_GET['host'] != "")) {
    $host = $_GET['host'];
}

?>


<html>
<head>
<title>FITB - Search Results for <?php echo $searchquery ?></title>
<link rel="stylesheet" href="fitb.css" type="text/css" media="screen" /> 
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js"></script>
<script type="text/javascript" src="fitb.js"></script>
<meta http-equiv="refresh" content="60">
</head>

<body>
<?php include_once('header.php'); # includes the <div> for the header ?>
<div id="wrap">
    <?php include_once('side.php'); # includes the <div> for the side bar ?>
    <div id="main">
        <?php
            if (isset($host)) {
                echo "<h2>Search Results for \"{$searchquery}\" on host {$host}</h2>";
            } elseif (isset($type)) {
                echo "<h2>Search Results for \"{$searchquery}\", type {$type}</h2>";
            } else {
                echo "<h2>Search Results for \"{$searchquery}\"</h2>";
            }
        ?>
            <?php
            connectToDB();
            $searchquery = mysql_real_escape_string($searchquery);

            if (isset($host)) {
                $host = mysql_real_escape_string($host);
                $type = mysql_real_escape_string($type);
                $result = mysql_query('SELECT * FROM ports WHERE (name like "%' . $searchquery . '%" OR alias like "%' . $searchquery . '%") 
                                            AND graphtype like "%' . $type . '%" AND host="' . $host . '" ORDER BY lastpoll DESC, safename ASC');
            } elseif (isset($type)) {
                $type = mysql_real_escape_string($type);
                $result = mysql_query('SELECT * FROM ports WHERE (name like "%' . $searchquery . '%" OR alias like "%' . $searchquery . '%") 
                                            AND graphtype="' . $type . '" ORDER BY lastpoll DESC, safename ASC');
            } else {
                $result = mysql_query('SELECT * FROM ports WHERE (name like "%' . $searchquery . '%" OR alias like "%' . $searchquery . '%")
                                            ORDER BY lastpoll DESC, safename ASC');
            }
            if(mysql_num_rows($result) > 0) {
                $numresults = mysql_num_rows($result);
                echo "<div class=\"small\">{$numresults} results found</div>";
                while ($row = mysql_fetch_assoc($result)) {
                    $staletag = "";
                    if ((time() - $row['lastpoll']) > $staleage) {
                        $staletag = "STALE: ";
                    }
                    $friendlytitle = urlencode("{$staletag}{$row['host']} - {$row['name']} ({$row['alias']})");
                    $basegraphurl = "graph.php?host={$row['host']}&rrdname={$row['host']}-{$row['safename']}&type={$row['graphtype']}{$start}&friendlytitle={$friendlytitle}";
                    echo '<a href="view' . $basegraphurl . '">';
                    echo '<img src="' . $basegraphurl . '&height=100&width=400" alt="'.$row['alias'].'"></a>';
                }
            } else {
                echo "No results :( ";
            }
        ?>

    <div>
</div>


</body>
</html>

Alerts (20)

'include_once(' Dynamic include_once detected; prefer static paths for security and clarity
2
'$_GET[' Unbounded request input detected; limit size (e.g., check Content-Length or use max input vars) to prevent memory exhaustion
3 6 7 9 10 13 14
Complexity hotspot; line 9 (total complexity: 3)
9
Complexity hotspot; line 13 (total complexity: 3)
13
Complexity hotspot; lines 38 to 40 (total complexity: 3)
38 39 40
'mysql_real_escape_string(' Outdated escaping; use PDO or MySQLi prepared statements for stronger SQL injection protection
45 48 49 53
'SELECT * FROM' Avoid SELECT *; specify columns for better performance and maintainability
50 54 57