CodeSOD: Message Oriented Database

Mark was debugging some database querying code, and got a bit confused about what it was actually doing. Specifically, it generated a query block like this:

<span class="hljs-variable">$statement</span>=<span class="hljs-string">"declare @status int
        declare @msg varchar(30)
        exec @status=sp_doSomething 'arg1', ...
        select @msg=convert(varchar(10),@status)
        print @msg
        "</span>;

<span class="hljs-variable">$result</span> = <span class="hljs-title function_ invoke__">sybase_query</span> (<span class="hljs-variable">$statement</span>, <span class="hljs-variable">$this</span>->connection);

Run a stored procedure, capture its return value in a variable, stringify that variable and print it. The select/print must be for debugging, right? Leftover debugging code. Why else would you do something like that?

<span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">sybase_get_last_message</span>()!==<span class="hljs-string">'0'</span>) {
    ...
}

Oh no. sybase_get_last_message gets the last string printed out by a print statement. This is a pretty bonkers way to get the results of a function or procedure call back, especially when if there are any results (like a return value), they’ll be in the $result return value.

Now that said, reading through those functions, it’s a little unclear if you can actually get the return value of a stored procedure this way. Without testing it myself (and no, I’m not doing that), we’re in a world where this might actually be the best way to do this.

So I’m not 100% sure where the WTF lies. In the developer? In the API designers? Sybase being TRWTF is always a pretty reliable bet. I suppose there’s a reason why all those functions are listed as “REMOVED IN PHP 7.0.0”, which was was rolled out through 2015. So at least those functions have been dead for a decade.

[Advertisement]
Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

Source: Read More