DB/PreparedSQLPlaceholders: false negatives for namespaced and method calls to sprintf()

Bug Description

The WordPress.DB.PreparedSQLPlaceholders sniff incorrectly treats namespaced function calls and method calls to sprintf() as if they were calls to the global sprintf() function, causing false negatives.

The sniff has special handling for the dynamic placeholder pattern using sprintf(). When it encounters a namespaced call like MyNamespace\sprintf() or a method call like $obj->sprintf(), it incorrectly applies this special handling instead of treating the call as an unknown function.

This issue only affects sprintf(). The detection of implode() and array_fill() already correctly filters out namespaced and method calls.

Minimal Code Snippet

The issue happens when running this command:

phpcs --standard=WordPress --sniffs=WordPress.DB.PreparedSQLPlaceholders test.php

... over a file containing this code:

<?php

$wpdb->prepare(
	MyNamespace\sprintf(
		'SELECT * FROM `table` WHERE `ID` IN (%s)',
		implode( ',', array_fill( 0, count( $ids ), '%s' ) )
	),
	$ids
);

$wpdb->prepare(
	$obj->sprintf(
		'SELECT * FROM `table` WHERE `ID` IN (%s)',
		implode( ',', array_fill( 0, count( $ids ), '%s' ) )
	),
	$ids
);

Expected behavior:

Both lines should be flagged. MyNamespace\sprintf() and $obj->sprintf() are not the global sprintf() function, so the dynamic placeholder pattern should not apply.

Actual behavior:

No errors or warnings. The sniff treats both calls as global sprintf() and applies the dynamic placeholder pattern handling.

Environment

Tested Against develop Branch?

• I have verified the issue still exists in the develop branch of WordPressCS.

Start with the WordPress.DB.PreparedSQLPlaceholders sniff and reproduce the report using the shown phpcs command and PHP snippet. Compare the handling of global sprintf() with the namespaced and method-call forms; done means both non-global calls are reported instead of receiving the global sprintf() special handling.