Home

Code review (xmlsitemap_user)

  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
  • : Function ereg() is deprecated in /opt/home/drupalcode/public_html/includes/file.inc on line 649.
Coder found 1 projects, 2 files
Coder provides helpful hints without false positives, but offers no guarantee for creating good code. You are the final arbitrar. If in doubt, read the Drupal documentation (see review links below and api.drupal.org).
Use the Selection Form to select options for this code review, or change the Default Settings and use the Default tab above.
sites/default/modules/xmlsitemap/xmlsitemap_user/xmlsitemap_user.module

xmlsitemap_user.module

  • severity: criticalclick to read moreLine 196: In SQL strings, Use db_query() placeholders in place of variables. This is a protential source of SQL injection attacks when the variable can come from user data. (Drupal Docs)
          $pid = db_result(db_query("SELECT pid FROM {url_alias} WHERE src = '%s'", "user/$account->uid"));
    Explanation: Use %s and %d variable substitution. When inserting an array of values use $placeholders = implode(',', array_fill(0, count($args), "'%s'"));
  • severity: criticalclick to read moreLine 212: In SQL strings, Use db_query() placeholders in place of variables. This is a protential source of SQL injection attacks when the variable can come from user data. (Drupal Docs)
          $pid = db_result(db_query("SELECT pid FROM {url_alias} WHERE src = '%s'", "user/$account->uid"));
    Explanation: Use %s and %d variable substitution. When inserting an array of values use $placeholders = implode(',', array_fill(0, count($args), "'%s'"));