← All changes | class/class-mainwp-db-base.php +66 -9 5.2 → 6.2.1 View file →

		@@ -8,8 +8,13 @@
8	8	*/
9	9
10	10	namespace MainWP\Dashboard;
11	11
	12	+// Exit if accessed directly.
	13	+if ( ! defined( 'ABSPATH' ) ) {
	14	+ exit;
	15	+}
	16	+
12	17	/**
13	18	* Class MainWP_DB_Base
14	19	*
15	20	* @package MainWP\Dashboard
		@@ -102,8 +107,17 @@
102	107	return $this->table_name( $suffix );
103	108	}
104	109
105	110	/**
	111	+ * Method get_wpdb_instance()
	112	+ *
	113	+ * @return object wpdb.
	114	+ */
	115	+ public function get_wpdb_instance() {
	116	+ return $this->wpdb;
	117	+ }
	118	+
	119	+ /**
106	120	* Method get_my_sql_version()
107	121	*
108	122	* Get MySQL Version.
109	123	*
		@@ -113,32 +127,64 @@
113	127	return $this->wpdb->get_var( 'SHOW VARIABLES LIKE "version"', 1 );
114	128	}
115	129
116	130	/**
	131	+ * Method get_var_field()
	132	+ *
	133	+ * Execute a SQL query and return a single variable.
	134	+ * This is a low-level wrapper for WPDB that expects SQL to be safely pre-constructed by callers.
	135	+ * Callers must ensure all dynamic values are either validated primitives or safely escaped.
	136	+ * See usage in get_sql_*() methods which construct safe SQL using whitelisted operations.
	137	+ *
	138	+ * @param string $sql Safe SQL query string. Must be pre-constructed safely by caller.
	139	+ *
	140	+ * @return mixed Database query result or null.
	141	+ */
	142	+ public function get_var_field( $sql ) {
	143	+ if ( null === $sql ) {
	144	+ return null;
	145	+ }
	146	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql is safe by contract; callers construct via get_sql_*() methods with validated/escaped values. All call sites verified in mainwp-db.php.
	147	+ return $this->wpdb->get_var( $sql );
	148	+ }
	149	+
	150	+ /**
117	151	* Method get_row_result()
118	152	*
119		- * Get row result.
	153	+ * Execute a SQL query and return a single row result.
	154	+ * This is a low-level wrapper for WPDB that expects SQL to be safely pre-constructed by callers.
	155	+ * Callers must ensure all dynamic values are either validated primitives or safely escaped.
	156	+ * See usage in get_sql_*() methods which construct safe SQL using whitelisted operations.
120	157	*
121		- * @param mixed $sql SQL Query.
	158	+ * @param mixed $sql Safe SQL query string. Must be pre-constructed safely by caller.
	159	+ * @param int $obj Return type: OBJECT or ARRAY_A (defaults to OBJECT).
122	160	*
123		- * @return mixed null|Row
	161	+ * @return mixed Single row result or null.
124	162	*/
125		- public function get_row_result( $sql ) {
	163	+ public function get_row_result( $sql, $obj = OBJECT ) {
126	164	if ( null === $sql ) {
127	165	return null;
128	166	}
129	167
130		- return $this->wpdb->get_row( $sql, OBJECT );
	168	+ if ( ! in_array( $obj, array( OBJECT, ARRAY_A ) ) ) {
	169	+ $obj = OBJECT;
	170	+ }
	171	+
	172	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql is safe by contract; callers construct via get_sql_*() methods with validated/escaped values. All call sites verified in mainwp-db.php.
	173	+ return $this->wpdb->get_row( $sql, $obj );
131	174	}
132	175
133	176	/**
134	177	* Method get_results_result()
135	178	*
136		- * Get Results of result.
	179	+ * Execute a SQL query and return multiple results indexed by primary key.
	180	+ * This is a low-level wrapper for WPDB that expects SQL to be safely pre-constructed by callers.
	181	+ * Callers must ensure all dynamic values are either validated primitives or safely escaped.
	182	+ * See usage in get_sql_*() methods which construct safe SQL using whitelisted operations.
137	183	*
138		- * @param mixed $sql SQL query.
	184	+ * @param mixed $sql Safe SQL query string. Must be pre-constructed safely by caller.
139	185	*
140		- * @return mixed null|get_results()
	186	+ * @return mixed Array of results indexed by primary key, or null.
141	187	*/
142	188	public function get_results_result( $sql ) {
143	189	if ( null === $sql ) {
144	190	return null;
		@@ -143,8 +189,9 @@
143	189	if ( null === $sql ) {
144	190	return null;
145	191	}
146	192
	193	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql is safe by contract; callers construct via get_sql_*() methods with validated/escaped values. All call sites verified in mainwp-db.php.
147	194	return $this->wpdb->get_results( $sql, OBJECT_K );
148	195	}
149	196
150	197	/**
		@@ -242,9 +289,19 @@
242	289	* @return mixed \mysqli_ping
243	290	*/
244	291	public static function ping( $link ) {
245	292	if ( self::use_mysqli() ) { // NOSONAR - required.
246		- return \mysqli_ping( $link );
	293	+ if ( version_compare( phpversion(), '8.4', '<' ) ) {
	294	+ return \mysqli_ping( $link );
	295	+ } else {
	296	+ try {
	297	+ self::$instance->wpdb->query( 'DO 1' );
	298	+ return true;
	299	+ } catch ( \mysqli_sql_exception $e ) { // NOSONAR - ok.
	300	+ // error.
	301	+ return false;
	302	+ }
	303	+ }
247	304	} else {
248	305	return \mysql_ping( $link );
249	306	}
250	307	}