Use prepared statements and add PHPStan config #8
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bugbot free trial expires on September 6, 2025
Learn more in the Cursor dashboard.
| } | ||
| $suminUSD = $sum * $tonrate; | ||
| $takenSum = ($sum+$fee)." TON"; | ||
| } |
There was a problem hiding this comment.
Bug: Null Object Access in Database Queries
The refactoring to prepared statements introduced several places where database result objects (like $row and $row5) can be null if a query fails or finds no results. Code in referralFee, takeFee, payOut, and tgbot.php's main logic then accesses properties of these potentially null objects without checking, causing fatal errors.
Additional Locations (4)
| $result = mysqli_stmt_get_result($stmt); | ||
| $row = $result ? mysqli_fetch_object($result) : null; | ||
| mysqli_stmt_close($stmt); | ||
| if($row && $row->ref == 0){ |
There was a problem hiding this comment.
Bug: Database Preparation Errors Not Handled
The saveReferral function uses the result of mysqli_prepare() without checking for success. Similarly, in referralFee, if statement preparation fails, the code attempts to access properties of a null object. Both scenarios can lead to fatal errors. Other database operations in this file correctly validate prepared statements or their results.
Additional Locations (1)
|
|
||
| $newtotalTon = $row3->ton_ton_full + $value; | ||
| $str2upd = "UPDATE `users` SET `ton_ton_full`='$newtotalTon' WHERE `chatid`='".$row->ref."'"; | ||
| mysqli_query($link, $str2upd); | ||
| $stmtUpd = mysqli_prepare($link, "UPDATE `users` SET `ton_ton_full`=? WHERE `chatid`=?"); |
There was a problem hiding this comment.
Bug: Null Object Access in Referral Fee Calculation
In referralFee, the code accesses $row3->ton_ton_full without checking if $row3 is null. If the preceding database query for $row3 doesn't return a result, $row3 will be null, causing a fatal error when attempting to access its ton_ton_full property.
Summary
Testing
php -l tgbot.phpphp -l func_gen.phpcomposer install(fails: CONNECT tunnel failed 403)https://chatgpt.com/codex/tasks/task_e_68a9daeabe44832cbce59ddf7545ad67