WordPress / WordPress/WordPress-Coding-Standards

PreparedSQLPlaceholders.UnquotedComplexPlaceholder: allow for tablenames in backticks

Open
#1,903 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Focus: DB Focus: Security Status: Needs investigation Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

Is your feature request related to a problem?

Given the following code snippet:

$wpdb->query(
	$wpdb->prepare(
		'TRUNCATE TABLE `%1$s`',
		plugin_get_table_name( 'Name' )
	)
);

WPCS will currently throw the following warning:

WARNING | Complex placeholders used for values in the query string in $wpdb->prepare() will
          NOT be quoted automagically. Found: %1$s.
          (WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder)

Describe the solution you'd like

In this particular case, I believe the warning should not be thrown.
Instead the sniff should recognize the backticks as valid "quotes" for a table name.

Note: this should only be accepted for table names, so, the sniff should probably look for TABLE or FROM before the placeholder.

Some research may need to be done into the various SQL syntaxes to make sure that the sniff recognizes the correct keywords and doesn't miss any real unquoted placeholders.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the PreparedSQLPlaceholders.UnquotedComplexPlaceholder sniff and its tests, then inspect how placeholders inside backticks are classified. Research the supported SQL syntax around TABLE and FROM before deciding which table-name cases are valid; done means valid backtick-quoted table placeholders no longer warn while unquoted value placeholders still do.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, sql
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.