MethodNotFound behaviour in PHP 5.3

Question

I am not a PHP developer, but I've been handed some legacy PHP code that I have to bug fix. I'm going to rewrite this code in C#, so I just need to understand why it's not failing when I think it should.

First, a database object is instantiated and a SQL query is built:

$dbh = new PDO('pgsql:dbname=' . $dbname . ';host=' . $host, $dbuser, $dbpass, array(
    PDO::ATTR_PERSISTENT => true
));

$db2 = new PDO('pgsql:dbname=' . $dbname . ';host=' . $host, $dbuser, $dbpass, array(
    PDO::ATTR_PERSISTENT => true
));
$sql = "select b.uniqueid,b.name,";
$sql .= " a.id,a.servertime,a.devicetime,a.latitude,a.longitude,speed,course,accuracy";
$sql .= " from tc_positions a, tc_devices b";
$sql .= " where a.deviceid = b.id and a.processed = 0";
$sql .= " order by a.devicetime";

Then, the SQL query is executed, and the records are processed individually:

$stmt = $dbh->query($sql);
$x = 0;
while ($data = $stmt->fetch(PDO::FETCH_ASSOC)) {
    $x++;
    try {
        $gps = new GpsDevice(array('identity' => $data['uniqueid']));
    } catch (fNotFoundException $e) {
        $gps = new GpsDevice();
        $gps->setIdentity($data['uniqueid']);
        $gps->setComments('Tracker->' . $data['name']);
        $gps->store();
    }

    // begin functions under question
    $loc = new GpsDeviceLocation();
    $loc->setGpsDeviceId($gps->getGpsDeviceId());
    $loc->setCreated($data['devicetime'] . ' +00');
    $loc->setReceived($data['servertime'] . ' +00');
    $loc->setLat($data['latitude']);
    $loc->setLon($data['longitude']);
    $loc->setHeading($data['course']);
    $loc->setSpeed($data['speed'] / 1.60934);
    $loc->setAccuracy($data['accuracy']);
    // end functions in question

    $loc->store();
    $loc->free();
    $loc = null;
    $gps->free();
    $gps = null;
    print($data['uniqueid'] . "\n");


    $sql2 = 'update tc_positions set processed = 1 where id = ' . $data['id'];

    $db2->query($sql2);
}

As I'm not a PHP developer, I'm relying on my very limited PHP knowledge and PHPStorm to help me understand what is happening. $loc is set to a new instance of GpsDeviceLocation, which is a class, built like this:

// using flourish-classes
class GpsDeviceLocation extends fActiveRecord { }

The part I don't understand is when this bit is called, $loc->setGpsDeviceId($gps->getGpsDeviceId()); (as well as the other methods in question), there's no matching method. Normally, in Python or C#, there would be an exception thrown at execution or compile time, but the code isn't throwing any errors, and the script is running as intended, I've verified in the downstream database that records are getting processed as intended. I've searched the code base and there isn't a single reference to any of those methods except in that file.

I feel like there should be an exception thrown, but there isn't. From what I can tell, this code should fail, but it's not, and I don't understand why. What is the behaviour of missing methods in PHP 5.3?

maybe there is a magic method there that handle unwritten methods. look at this link : https://www.php.net/manual/en/language.oop5.magic.php — S.Kashizadeh, Sep 08 '20 at 18:31
I would imagine that, in this scenario, it'd be possible the methods and properties themselves are inherited from `fActiveRecord`. — esqew, Sep 08 '20 at 18:32
You should know that it's highly likely that your PHP code is vulnerable to a critical [SQL injection vulnerability](https://stackoverflow.com/questions/601300/what-is-sql-injection) as you're directly concatenating PHP variables into your query. You really should use [prepared statements and parameterized queries](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) to mitigate this. — esqew, Sep 08 '20 at 18:34

score 0 · Answer 1 · answered Sep 08 '20 at 18:49

By the name of methods and conventions its problably using Symfony 1 or something similar. Its a PHP framework, it has some custom functions, like getGpsDeviceId, the framework understand that it need to return the field gps_device_id or id_device_gps, they use an old ORM, the functions are created automatically. PHP Storm will probably not tell where the code is because its a very old thing and people didn't developed a plugin to backtrace this. To know what application is doing I recommend you to find the files that describe the architecture like a composer.json or a require() function, after you find the framework you can check the documentation on official website.

Example of Symfony 1: https://symfony.com/legacy/doc/gentle-introduction/1_4/en/01-Introducing-Symfony

MethodNotFound behaviour in PHP 5.3

1 Answers1