| @@ -502,10 +502,15 @@ | ||
| 502 | 502 | |
| 503 | 503 | $current = null; |
| 504 | 504 | if ($row_existed) { |
| 505 | 505 | $select = '`' . implode('`, `', array_map('esc_sql', $columns)) . '`'; |
| 506 | - $current = $wpdb->get_row( | |
| 507 | - $wpdb->prepare("SELECT {$select} FROM {$table} WHERE term_id = %d", $term_id), | |
| 506 | + // Column list is esc_sql()'d above; the table is a fixed literal. | |
| 507 | + $current = $wpdb->get_row( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- mirrors term meta into third-party plugin storage (Yoast/AIOSEO tables) — no WordPress API for their schemas | |
| 508 | + $wpdb->prepare( | |
| 509 | + // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- column list esc_sql()'d above, table is a fixed literal | |
| 510 | + "SELECT {$select} FROM {$wpdb->prefix}aioseo_terms WHERE term_id = %d", | |
| 511 | + $term_id | |
| 512 | + ), | |
| 508 | 513 | ARRAY_A |
| 509 | 514 | ); |
| 510 | 515 | |
| 511 | 516 | // The row was there a moment ago, so a null answer now is a failed |
| @@ -571,9 +576,9 @@ | ||
| 571 | 576 | |
| 572 | 577 | $table = $wpdb->prefix . 'aioseo_terms'; |
| 573 | 578 | |
| 574 | 579 | // Bail if the AIOSEO term table does not exist (plugin not initialised). |
| 575 | - $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table)); | |
| 580 | + $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- mirrors term meta into third-party plugin storage (Yoast/AIOSEO tables) — no WordPress API for their schemas | |
| 576 | 581 | if ($table_exists !== $table) { |
| 577 | 582 | return false; |
| 578 | 583 | } |
| 579 | 584 | |
| @@ -606,10 +611,10 @@ | ||
| 606 | 611 | } |
| 607 | 612 | |
| 608 | 613 | $row['updated'] = current_time('mysql'); |
| 609 | 614 | |
| 610 | - $existing_id = $wpdb->get_var($wpdb->prepare( | |
| 611 | - "SELECT id FROM {$table} WHERE term_id = %d", | |
| 615 | + $existing_id = $wpdb->get_var($wpdb->prepare( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- mirrors term meta into third-party plugin storage (Yoast/AIOSEO tables) — no WordPress API for their schemas | |
| 616 | + "SELECT id FROM {$wpdb->prefix}aioseo_terms WHERE term_id = %d", | |
| 612 | 617 | $term_id |
| 613 | 618 | )); |
| 614 | 619 | |
| 615 | 620 | // An unreadable probe cannot be treated as "no row". It would commit a |
| @@ -628,9 +633,9 @@ | ||
| 628 | 633 | if (!$this->backup_aioseo_columns($term_id, $table, $row, true, $backups_created)) { |
| 629 | 634 | return false; |
| 630 | 635 | } |
| 631 | 636 | |
| 632 | - $updated = $wpdb->update($table, $row, ['term_id' => $term_id]); | |
| 637 | + $updated = $wpdb->update($table, $row, ['term_id' => $term_id]); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- mirrors term meta into third-party plugin storage (Yoast/AIOSEO tables) — no WordPress API for their schemas | |
| 633 | 638 | return $updated !== false; |
| 634 | 639 | } |
| 635 | 640 | |
| 636 | 641 | $backups_created = []; |
| @@ -657,9 +662,9 @@ | ||
| 657 | 662 | ]; |
| 658 | 663 | // Merge defaults first, then $row on top so our noindex value wins. |
| 659 | 664 | $row = array_merge($robot_defaults, $row); |
| 660 | 665 | |
| 661 | - $inserted = $wpdb->insert($table, $row); | |
| 666 | + $inserted = $wpdb->insert($table, $row); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- mirrors term meta into third-party plugin storage (Yoast/AIOSEO tables) — no WordPress API for their schemas | |
| 662 | 667 | |
| 663 | 668 | // The row_existed='0' marker was recorded before the insert, because a |
| 664 | 669 | // marker that will not save has to be able to veto the write. A failed |
| 665 | 670 | // insert leaves no row of ours, and a marker still claiming one would |
