You are here

class VariableSetSanitizeSniff in Coder 8.2

Same name and namespace in other branches
  1. 8.3 coder_sniffer/DrupalPractice/Sniffs/FunctionCalls/VariableSetSanitizeSniff.php \DrupalPractice\Sniffs\FunctionCalls\VariableSetSanitizeSniff
  2. 8.3.x coder_sniffer/DrupalPractice/Sniffs/FunctionCalls/VariableSetSanitizeSniff.php \DrupalPractice\Sniffs\FunctionCalls\VariableSetSanitizeSniff

Check that variable_set() calls do not run check_plain() or other sanitization functions on the value.

@category PHP @package PHP_CodeSniffer @link http://pear.php.net/package/PHP_CodeSniffer

Hierarchy

Expanded class hierarchy of VariableSetSanitizeSniff

File

coder_sniffer/DrupalPractice/Sniffs/FunctionCalls/VariableSetSanitizeSniff.php, line 23

Namespace

DrupalPractice\Sniffs\FunctionCalls
View source
class VariableSetSanitizeSniff extends FunctionCall {

  /**
   * Returns an array of function names this test wants to listen for.
   *
   * @return array
   */
  public function registerFunctionNames() {
    return array(
      'variable_set',
    );
  }

  //end registerFunctionNames()

  /**
   * Processes this function call.
   *
   * @param \PHP_CodeSniffer\Files\File $phpcsFile    The file being scanned.
   * @param int                         $stackPtr     The position of the function call in
   *                                                  the stack.
   * @param int                         $openBracket  The position of the opening
   *                                                  parenthesis in the stack.
   * @param int                         $closeBracket The position of the closing
   *                                                  parenthesis in the stack.
   *
   * @return void
   */
  public function processFunctionCall(File $phpcsFile, $stackPtr, $openBracket, $closeBracket) {
    $tokens = $phpcsFile
      ->getTokens();
    $argument = $this
      ->getArgument(2);
    if ($argument !== false && in_array($tokens[$argument['start']]['content'], array(
      'check_markup',
      'check_plain',
      'check_url',
      'filter_xss',
      'filter_xss_admin',
    )) === true) {
      $warning = 'Do not use the %s() sanitization function when writing values to the database, use it on output to HTML instead';
      $data = array(
        $tokens[$argument['start']]['content'],
      );
      $phpcsFile
        ->addWarning($warning, $argument['start'], 'VariableSet', $data);
    }
  }

}

Members

Namesort descending Modifiers Type Description Overrides
FunctionCall::$arguments protected property Internal cache to save the calculated arguments of the function call.
FunctionCall::$closeBracket protected property The token position of the closing bracket of the function call.
FunctionCall::$functionCall protected property The token position of the function call.
FunctionCall::$includeMethodCalls protected property Whether method invocations with the same function name should be processed, too. 1
FunctionCall::$openBracket protected property The token position of the opening bracket of the function call.
FunctionCall::$phpcsFile protected property The currently processed file.
FunctionCall::getArgument public function Returns start and end token for a given argument number.
FunctionCall::isFunctionCall protected function Checks if this is a function call.
FunctionCall::process public function Processes this test, when one of its tokens is encountered. 1
FunctionCall::register public function Returns an array of tokens this test wants to listen for.
VariableSetSanitizeSniff::processFunctionCall public function Processes this function call.
VariableSetSanitizeSniff::registerFunctionNames public function Returns an array of function names this test wants to listen for.