WordPress / WordPress/WordPress-Coding-Standards

Add a check to recommend that the `%i` placeholders are used for identifier names instead of `$wpdb->tablename` or `%1$s`-like placeholders.

Open
#2,079 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Focus: DB Focus: Security Status: Needs investigation Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

Following up on PR #2072, and suggested by Juliette.

  • This would need the same research as mentioned [in #2078].
  • This check would need to use the MinimumWPVersionTrait to determine whether the recommendation should be shown or not, based on the minimum WP version a plugin/theme supports.

When it comes to %1$s-like placeholders, I'm very much in favour of this (it's why $wpdb->allow_unsafe_unquoted_parameters exists, and my plan over the next ~10 years is to eventually remove that risky feature, where %1$s-like placeholders are not quoted, because developers must remember to correctly add quotes themselves).

With $wpdb->tablename, I have created WordPress Ticket #56091 (specifically PR #3016), so WordPress could use %i for some table names. But my concern while making this PR was that it made queries a bit harder to read (it's not immediately obvious which table is being used). Also, I cannot imagine there are many developers who need their $table_prefix to contain characters other than [a-zA-Z0-9_]... that said, while I am aiming for wpdb::prepare() to require a literal-string for its first argument (i.e. a developer defined string), maybe that will be too hard for WPDB to check (being able to trace the variable back to all of its sources)?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading PR #2072 and issue #2078 for the required research, then inspect the MinimumWPVersionTrait and the WordPress database placeholder behavior described here. The work is done when the coding-standard check recommends %i for supported identifier names and handles %1$s-like placeholders and minimum WordPress versions as agreed.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.