← All changes | database/Migrations/DataMetrixMigrator.php +12 -9 1.10.0 → 2.4.0 View file →

		@@ -13,9 +13,9 @@
13	13	$charsetCollate = $wpdb->get_charset_collate();
14	14
15	15	$table = $wpdb->prefix . static::$tableName;
16	16
17		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	17	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
18	18	$sql = "CREATE TABLE $table (
19	19	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
20	20	`stat_date` DATE NOT NULL,
21	21	`data_type` VARCHAR(100) DEFAULT 'agent_stat',
		@@ -40,9 +40,9 @@
40	40
41	41	return false;
42	42	}
43	43
44		- public static function alterTable($table)
	44	+ public static function alterTable($table)
45	45	{
46	46	static::addMissingIndexes($table);
47	47	}
48	48
		@@ -49,13 +49,15 @@
49	49	public static function addMissingIndexes($table)
50	50	{
51	51	global $wpdb;
52	52
53		- // Escape table name
	53	+ // $table is always $wpdb->prefix . 'fs_data_metrix' — not user input.
	54	+ // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
	55	+ // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
54	56	$table = esc_sql($table);
55	57
56	58	// Get existing indexes
57		- $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `$table`");
	59	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
58	60	$existing_index_names = [];
59	61
60	62	foreach ($existing_indexes as $index) {
61	63	$existing_index_names[] = $index->Key_name;
		@@ -60,20 +62,21 @@
60	62	foreach ($existing_indexes as $index) {
61	63	$existing_index_names[] = $index->Key_name;
62	64	}
63	65
64		- // Desired indexes
	66	+ // Desired indexes — keys and values are all hardcoded string literals.
65	67	$indexes = [
66	68	'idx_stat_date' => 'stat_date',
67		- 'idx_agent_id' => 'agent_id',
	69	+ 'idx_agent_id' => 'agent_id',
68	70	'idx_data_type' => 'data_type',
69	71	];
70	72
71		- // Add missing indexes
	73	+ // Add missing indexes. $table is esc_sql()'d above; $index_name and
	74	+ // $column_name are hardcoded array literals — no user input reaches this query.
72	75	foreach ($indexes as $index_name => $column_name) {
73	76	if (!in_array($index_name, $existing_index_names)) {
74		- $sql = "ALTER TABLE `$table` ADD INDEX `$index_name` (`$column_name`)";
75		- $wpdb->query($sql);
	77	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	78	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");
76	79	}
77	80	}
78	81	}
79	82	}