Skip to content

refactor wpdb statements #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

refactor wpdb statements #165

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
dbe099d
refactor wpdb statements
jamesros161 Dec 19, 2022
7295530
refactor
jamesros161 Dec 21, 2022
4591fb2
add newline
jamesros161 Dec 21, 2022
8fd1d12
fix semicolon
jamesros161 Dec 21, 2022
ca31e85
change formatting
jamesros161 Dec 21, 2022
42db485
change to array_merge
jamesros161 Dec 21, 2022
7bb32f0
change comment on get_post_status
jamesros161 Dec 21, 2022
e434eab
fix comment
jamesros161 Dec 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 77 additions & 25 deletions includes/class-boldgrid-inspirations-purchase-for-publish.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -988,7 +988,7 @@ public function get_local_publish_cost_data() {
*
* @since 1.1.4
*
* @return string A string to be used after in IN statement, example: ( 'draft', 'publish' ).
* @return array an array used after in IN statement, example: ( 'draft', 'publish' ).
*/
public function get_post_status() {
$post_status = array( 'draft', 'publish' );
Expand All @@ -1005,12 +1005,35 @@ public function get_post_status() {
*/
$post_status = apply_filters( 'boldgrid_cart_post_status', $post_status );

// Implode our array of $post_status to be used alongside an IN statement.
$post_status = '( "' . implode( '", "', esc_sql( $post_status ) ) . '" )';

return $post_status;
}

/**
* Generate prepare placeholders
*
* When properly preparing a mysql statement, the array
* string is dynamically generated to prevent improper
* escaping. This method will generate the array of placeholders
* to be used by that prepare string.
*
* @param array $values,
* @return array $placeholders
*/
public function get_prepare_placeholders( $values ) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method is get prepare placeholders.

The method itself is not doing any sql preparing, nor is it doing anything with placeholders. It's simply looping through an array and merging things.

Is it really needed? Maybe we rename it to something that makes more sense?

$placeholders = array();

foreach ( $values as $value ) {
if ( is_array( $value ) ) {
error_log( 'value is array: ' . json_encode( $value ) );
$placeholders = array_merge( $placeholders, $value );
} else {
$placeholders[] = $value;
}
}

return $placeholders;
}

/**
* Ajax calls come here to get details by transaction_item_id.
*
Expand Down Expand Up @@ -1297,15 +1320,30 @@ public function asset_needs_purchase( $asset, $asset_type, $args = array() ) {
* Is this image used within shortcode? For example, is image 123 used in a gallery, such as
* [gallery ids='123,456'].
*/
$regexp = '[\[][^\]]+[\'\", ]' . $attachment_id . '[^0-9]+.*[\]]';
$query = '
SELECT `ID`
FROM ' . $wpdb->posts . '
WHERE `post_status` IN ' . $post_status . ' AND
`post_type` IN ("page","post") AND
`post_content` REGEXP "' . $regexp . '"
';
$in_shortcode = $wpdb->get_var( $query );
$regexp = '[\\[][^\\]]+[\'\", ]' . $attachment_id . '[^0-9]+.*[\\]]';

/**
* Previously, we were not using a prepare statement.
* In order to ensure that the prepare statment
* doesn't incorrectly escape the post status array,
* we dynamically create the placeholders now.
*/
$placeholders = $this->get_prepare_placeholders(
array(
$post_status,
$regexp,
)
);

$in_shortcode = $wpdb->get_var(
$wpdb->prepare(
"SELECT `ID` FROM $wpdb->posts WHERE `post_status` IN ( " .
implode( ', ', array_fill( 0, count( $post_status ), '%s' ) ) .
" ) AND `post_type` IN ( 'page', 'post' ) AND `post_content` REGEXP %s",
...$placeholders
)
);

if ( ! empty( $in_shortcode ) ) {
$this->assets_needing_purchase['by_page_id'][ $in_shortcode ][] = $asset;
return true;
Expand All @@ -1314,17 +1352,27 @@ public function asset_needs_purchase( $asset, $asset_type, $args = array() ) {
/**
* Is this a featured image needing attribution?
*/
$placeholders = $this->get_prepare_placeholders(
array(
$attachment_id,
$post_status,
)
);

$asset_a_featured_image = $wpdb->get_var(
$wpdb->prepare(
" SELECT `post_id`
"SELECT `post_id`
FROM $wpdb->postmeta,
$wpdb->posts
WHERE $wpdb->postmeta.meta_key = '_thumbnail_id' AND
$wpdb->postmeta.meta_value = %s AND
$wpdb->postmeta.post_id = $wpdb->posts.ID AND
$wpdb->posts.post_status IN $post_status AND
$wpdb->posts.post_type IN ('page','post')
", $attachment_id ) );
$wpdb->posts.post_status IN ( " .
implode( ', ', array_fill( 0, count( $post_status ), '%s' ) ) .
") AND $wpdb->posts.post_type IN ('page','post')",
...$placeholders
)
);

// If we found results, then the image is being used in a page/post.
if ( ! empty( $asset_a_featured_image ) ) {
Expand Down Expand Up @@ -1417,14 +1465,18 @@ public function asset_needs_purchase( $asset, $asset_type, $args = array() ) {

// SELECT post_title where post_content like
// '%2015/02/google-maps-int-1410976385-pi.jpg%'
$query = $wpdb->prepare("
SELECT `ID`
FROM $wpdb->posts
WHERE `post_content` LIKE %s AND
`post_status` IN $post_status AND
`post_type` IN ('page','post')
",
'%' . $wpdb->esc_like( $file_name_to_query ) . '%'
$placeholders = $this->get_prepare_placeholders(
array(
$post_status,
'%' . $wpdb->esc_like( $file_name_to_query ) . '%',
)
);

$query = $wpdb->prepare(
"SELECT `ID` FROM $wpdb->posts WHERE `post_content` LIKE %s AND `post_status` IN ( " .
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm trying to peer review and figure out what has changed... The PR can be much cleaner and easier to understand by not reformatting, unless it needs to be.

implode( ', ', array_fill( 0, count( $post_status ), '%s' ) ) .
" ) AND `post_type` IN ('page','post')",
...$placeholders
);

// If we want to exclude any page IDs, exclude them now.
Expand Down