WordPress / WordPress/WordPress-Coding-Standards
Allow prepared queries to be passed in via a variable
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Given the following code, a WordPress.WP.PreparedSQL.NotPrepared error is raised:
$query = $wpdb->prepare( "
SELECT ID
FROM {$wpdb->posts}
WHERE post_type = %s
", $post_type );
$all_post_ids = $wpdb->get_col( $query );
The error is raised because the prepared query is passed in via a variable instead of prepare() being called directly inside get_col().
Is there a way that this format can be supported in WPCS?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the WordPress.WP.PreparedSQL.NotPrepared sniff against the issue's prepared-query example and inspect how existing tests cover queries passed to database methods. Done means a prepared query stored in a variable is accepted without suppressing genuinely unprepared queries, with regression coverage for this format.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100