Hey Pittsburgh Readers – I'll be in town this weekend, so who's up for grabbing a couple drinks tomorrow, Friday (July 13) Night at Market Square? Mark, Remy, and I will be there -- just drop me a line and we'll catch up. Oh, and I'll make sure to bring a TDWTF Mug for you if you’d like one (just let me know).

"A fairly ambitious project at work necessitated some extra, temporary help," wrote Richard, "and that meant it was time to bring on another contractor. After interviewing a number of different candidates, I found one that seemed to fit the bill. He had the necessary PHP skills, knowledge, and experience – and most importantly, he was will willing to work at the rate my company was willing to pay."

"In the interview, he mentioned that he was starting his own company, and that his main asset would be his home-grown CMS. Curious as to how his would compete with the likes of Drupal, Joomla, and the like, he simply responded 'well, mine will be better.'  In retrospect, perhaps that should have been my red flag."

"When debugging some of the code that he left behind, I found a mysql_class.php containing (amongst other gems) the following method. I suppose I should have known that this guy would also have made his own MySQL wrapper wrapper class.

    function query($qeury){
        $resultArray = array();
        $qeury = trim($qeury);

        $q=$qeury ;                             // development mode -- return the qeury in a array --
        //$q='';                                // default empty for the live mode

        $con_menuData= mysql_query($qeury);    // run the sql qeury
        if($con_menuData){

            //query successful
            if(strtolower(substr($qeury, 0,6))== "select"){

                ///loop through the result and full the array as a dubble array(number => array(sql row) )
                while($con_menu = mysql_fetch_object($con_menuData)) {
                    $resultArray[] =  $con_menu;
                }

                //make a single array if you expect one row
                if(substr( strtolower($qeury) ,-7) == 'limit 1' && $resultArray){
                    $resultArray = $resultArray[0];
                }

            }else{
                ///query successful but not a select (insert | update | ect.)
                $lastID = mysql_insert_id();
                $resultArray[0]= array('success'=>true,'lastID'=>$lastID,'query'=> $q);
            }
        }else{
            //query unsuccessful return false array
            $resultArray[0]= array('success'=>false,'lastID'=>false,'query'=> $q);
        }

        // log all
        $this->logAllQeurys($qeury);
        return $resultArray;
    }

    function logAllQeurys($qeury){
        // log all query's
        //echo $qeury."<br>";
    }

Richard continued, "note the consistent mis-spelling of $qeury, the lack of error logging, the cool parsing code to find the expected behavior of the method, and the way that the result returns completely different types depending on what the user of the class would 'expect'."

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!