PHP code example of yd-shomer / php-shomer

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

yd-shomer / php-shomer example snippets

Shomer\QueryValidator;

// Enable Shomer in development
define('SHOMER_ENABLED', true);

// Validate a prepared statement
$report = QueryValidator::validate([
    'sql' => "INSERT INTO users (name, email) VALUES (?, ?)",
    'params' => ['John Doe', '[email protected]']
], true, true);

if ($report['status'] === 'error') {
    echo "⚠️ Query validation failed!\n";
    print_r($report['erreurs']);
}

// Simply set to false - zero overhead!
define('SHOMER_ENABLED', false);

use Shomer\QueryValidator;

$query = [
    'sql' => "SELECT * FROM users WHERE email = :email AND status = :status",
    'params' => [
        'email' => '[email protected]',
        'status' => 'active'
    ]
];

$report = QueryValidator::validate($query, true, true);

$query = [
    'sql' => "INSERT INTO users (name, email, age) VALUES (?, ?, ?)",
    'params' => ['John', '[email protected]'] // ⚠️ Missing parameter!
];

$report = QueryValidator::validate($query, true);

// Shomer will detect: "CRITICAL ERROR: Placeholder count (3) differs from parameter count (2)"

$query = [
    'sql' => "SELECT * FROM users WHERE username = ?",
    'params' => ["admin' OR '1'='1"] // ⚠️ Injection attempt
];

$report = QueryValidator::validate($query, true, true);

// Shomer will warn: "SQL keyword 'OR' detected in parameter"

$unsafeQuery = "SELECT * FROM users WHERE id = " . $_GET['id'];

$report = QueryValidator::validate($unsafeQuery, true);

// Shomer will alert: "SECURITY WARNING: Non-prepared query detected"

// Send error reports via email
$report = QueryValidator::validate($query, true, true, 1);

// Or use custom email function
$report = QueryValidator::validate($query, true, true, 'my_custom_email_function');

// config.php

// Enable/disable Shomer
define('SHOMER_ENABLED', true); // false in production

// Email configuration (optional)
define('SHOMER_EMAIL', '[email protected]');
define('SHOMER_EMAIL_FROM', '[email protected]');

use Shomer\QueryValidator;
use Shomer\Reports\ValidationReport;

// Validate with full details
$report = QueryValidator::validate(
    $query,        // Query array or string
    true,          // Enable validation
    true,          // Verbose mode (all details)
    'send_alert'   // Custom email function
);

// Access report data
if ($report['nb_erreurs'] > 0) {
    foreach ($report['erreurs'] as $error) {
        error_log("Shomer Alert: $error");
    }
}

if ($report['nb_avertissements'] > 0) {
    foreach ($report['avertissements'] as $warning) {
        error_log("Shomer Warning: $warning");
    }
}

[
    'status' => 'error',           // 'success', 'error', or 'bypassed'
    'is_prepared' => true,         // Is it a prepared statement?
    'query' => 'SELECT ...',       // The SQL query
    'params' => [...],             // Parameters (if prepared)
    'erreurs' => [...],            // Array of errors
    'avertissements' => [...],     // Array of warnings
    'infos' => [...],              // Detailed information (if verbose)
    'nb_erreurs' => 2,             // Error count
    'nb_avertissements' => 1,      // Warning count
    'timestamp' => '2025-01-15 14:30:00',
    'context' => [                 // Execution context (NEW!)
        'file' => '/path/to/script.php',           // Absolute path
        'file_relative' => './src/UserService.php', // Relative path
        'line' => 42,                               // Line number
        'function' => 'validateUser',               // Function name
        'class' => 'App\\UserService',              // Class name (if method)
        'type' => '->',                             // Method type (-> or ::)
        'url' => 'https://example.com/login',       // URL (web context)
        'method' => 'POST',                         // HTTP method
        'script_name' => '/var/www/public/index.php' // Script path
    ]
]

// Your problematic query
$query = "DELETE FROM users"; // Missing WHERE clause!

$report = QueryValidator::validate($query, true, true); // verbose = true

// Shomer provides a suggestion:
$report['suggestion'] = [
    'query' => 'DELETE FROM users WHERE id = ?',
    'code' => '$stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
$stmt->execute([$id]);',
    'explanation' => 'CRITICAL: DELETE without WHERE clause will affect ALL rows...'
];

bash
composer