WordPress / WordPress/WordPress-Coding-Standards

Handbook: "Functions that update the database should expect their parameters to lack SQL slash escaping when passed."

Open
#640 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Focus: DB Type: Enhancement
Dominant language
PHP
Stars
2.8k
Forks
521
Avg merge
5d 20h
Merged PRs (30d)
1

Description

Ref: https://make.wordpress.org/core/handbook/best-practices/coding-standards/php/#formatting-sql-statements

We could possibly verify that variables passed to $wpdb->prepare() don't have a slashing function around it ?

Could possibly be added to the WordPress.WP.PreparedSQL WordPress.WP.PreparedSQLPlaceholders sniff.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked WordPress PHP coding-standard guidance and the WordPress.WP.PreparedSQLPlaceholders sniff. Determine how variables passed to $wpdb->prepare() are currently checked; done means the sniff identifies slashing functions around those variables and has corresponding coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.