WordPress / WordPress/WordPress-Coding-Standards
Add a check to recommend that the `%i` placeholders are used for identifier names instead of `$wpdb->tablename` or `%1$s`-like placeholders.
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 2.8k
- Forks
- 521
- Avg merge
- 5d 20h
- Merged PRs (30d)
- 1
Description
Following up on PR #2072, and suggested by Juliette.
- This would need the same research as mentioned [in #2078].
- This check would need to use the MinimumWPVersionTrait to determine whether the recommendation should be shown or not, based on the minimum WP version a plugin/theme supports.
When it comes to %1$s-like placeholders, I'm very much in favour of this (it's why $wpdb->allow_unsafe_unquoted_parameters exists, and my plan over the next ~10 years is to eventually remove that risky feature, where %1$s-like placeholders are not quoted, because developers must remember to correctly add quotes themselves).
With $wpdb->tablename, I have created WordPress Ticket #56091 (specifically PR #3016), so WordPress could use %i for some table names. But my concern while making this PR was that it made queries a bit harder to read (it's not immediately obvious which table is being used). Also, I cannot imagine there are many developers who need their $table_prefix to contain characters other than [a-zA-Z0-9_]... that said, while I am aiming for wpdb::prepare() to require a literal-string for its first argument (i.e. a developer defined string), maybe that will be too hard for WPDB to check (being able to trace the variable back to all of its sources)?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading PR #2072 and issue #2078 for the required research, then inspect the MinimumWPVersionTrait and the WordPress database placeholder behavior described here. The work is done when the coding-standard check recommends %i for supported identifier names and handles %1$s-like placeholders and minimum WordPress versions as agreed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100