← All changes | helpers/QueryHelper.php +40 -77 trunk → 3.8.2 View file →

		@@ -187,15 +187,11 @@
187	187	*/
188	188	public static function insert_multiple_rows( $table, $request, $return_ids = false, $do_sanitize = true ) {
189	189	global $wpdb;
190	190
191		- if ( ! tutor_utils()->is_multi_dimensional_array( $request ) ) {
192		- return self::insert( $table, $request );
193		- }
194		-
195	191	$table = self::prepare_table_name( $table );
196	192	$column_keys = '';
197		- $column_values = array();
	193	+ $column_values = '';
198	194	$sql = '';
199	195	$last_key = array_key_last( $request );
200	196	$first_key = array_key_first( $request );
201	197	foreach ( $request as $k => $value ) {
		@@ -200,10 +196,8 @@
200	196	$first_key = array_key_first( $request );
201	197	foreach ( $request as $k => $value ) {
202	198	$keys = array_keys( $value );
203	199
204		- $value_placeholder = array();
205		-
206	200	// Prepare column keys & values.
207	201	foreach ( $keys as $v ) {
208	202	$column_keys .= sanitize_key( $v ) . ',';
209	203	$sanitize_value = $value[ $v ];
		@@ -209,39 +203,27 @@
209	203	$sanitize_value = $value[ $v ];
210	204	if ( $sanitize_value && $do_sanitize ) {
211	205	$sanitize_value = sanitize_text_field( $sanitize_value );
212	206	}
213		-
214		- $column_values[] = $sanitize_value;
215		-
216		- $value_placeholder[] = '%s';
	207	+ $column_values .= is_numeric( $sanitize_value ) ? $sanitize_value . ',' : "'$sanitize_value'" . ',';
217	208	}
218		-
219		- $value_placeholder = implode( ',', $value_placeholder );
220		-
221	209	// Trim trailing comma.
222	210	$column_keys = rtrim( $column_keys, ',' );
223		- $column_values = $wpdb->prepare( $value_placeholder, $column_values ); // Escape values.
224		-
	211	+ $column_values = rtrim( $column_values, ',' );
225	212	if ( $first_key === $k ) {
226		- $sql .= "INSERT INTO
227		- {$table}
228		- ($column_keys) VALUES ($column_values)
229		- ";
230		-
	213	+ $sql .= "INSERT INTO {$table} ($column_keys) VALUES ($column_values)";
231	214	if ( count( $request ) > 1 ) {
232	215	$sql .= ',';
233	216	}
234	217	} elseif ( $last_key == $k ) {
235		- $sql .= "( $column_values )";
	218	+ $sql .= "($column_values)";
236	219	} else {
237		- $sql .= "( $column_values ),";
238		-
	220	+ $sql .= "($column_values),";
239	221	}
240	222
241	223	// Reset keys & values to avoid duplication.
242	224	$column_keys = '';
243		- $column_values = array();
	225	+ $column_values = '';
244	226	}
245	227
246	228	$wpdb->query( $sql );//phpcs:ignore
247	229
		@@ -246,9 +228,9 @@
246	228	$wpdb->query( $sql );//phpcs:ignore
247	229
248	230	// If error occurred then throw new exception.
249	231	if ( $wpdb->last_error ) {
250		- throw new \Exception( esc_html( $wpdb->last_error ) );
	232	+ throw new \Exception( $wpdb->last_error );
251	233	}
252	234
253	235	if ( $return_ids ) {
254	236	$query_ids = $wpdb->get_results(
		@@ -269,9 +251,8 @@
269	251	* If the operator is IN then make the clause like `WHERE column_name IN (value1, value2, ...)`
270	252	* Otherwise the clause would be `WHERE column_name = 'value'`
271	253	*
272	254	* @since 3.0.0
273		- * @since 3.9.7 added prepared statement for value.
274	255	*
275	256	* @param array $where The where clause array. e.g. array( 'id', 'IN', array(1, 2, 3) ) or array( 'id', '=', 1 ).
276	257	*
277	258	* @return string
		@@ -279,18 +260,10 @@
279	260	public static function make_clause( array $where ) {
280	261	list ( $field, $operator, $value ) = $where;
281	262
282	263	$upper_operator = strtoupper( $operator );
283		-
284	264	if ( in_array( $upper_operator, array( 'IN', 'NOT IN' ), true ) ) {
285	265	$value = '(' . self::prepare_in_clause( $value ) . ')';
286		- } elseif ( in_array( $upper_operator, array( 'BETWEEN', 'NOT BETWEEN' ), true ) ) {
287		- $value = array_map( fn( $val ) => self::prepare_value( $val ), $value );
288		- $value = implode( ' AND ', $value );
289		- } elseif ( strtoupper( $value ) === 'NULL' ) {
290		- $value = 'NULL';
291		- } else {
292		- $value = self::prepare_value( $value );
293	266	}
294	267
295	268	return "{$field} {$upper_operator} {$value}";
296	269	}
		@@ -372,15 +345,17 @@
372	345
373	346	case 'BETWEEN':
374	347	case 'NOT BETWEEN':
375	348	if ( is_array( $val ) && count( $val ) === 2 ) {
376		- $clause = array( $field, $operator, $val );
	349	+ $val1 = is_numeric( $val[0] ) ? $val[0] : "'" . $val[0] . "'";
	350	+ $val2 = is_numeric( $val[1] ) ? $val[1] : "'" . $val[1] . "'";
	351	+ $clause = array( $field, $operator, "{$val1} AND {$val2}" );
377	352	}
378	353	break;
379	354
380	355	case 'IS':
381	356	case 'IS NOT':
382		- $val = strtoupper( $val ) === 'NULL' ? 'NULL' : $val;
	357	+ $val = strtoupper( $val ) === 'NULL' ? 'NULL' : "'" . $val . "'";
383	358	$clause = array( $field, $operator, $val );
384	359	break;
385	360	case 'RAW':
386	361	$final_query = '';
		@@ -389,8 +364,9 @@
389	364	}
390	365	$clause = $final_query;
391	366	break;
392	367	default: // =, !=, <, >, <=, >=, LIKE, NOT LIKE, <>
	368	+ $val = is_numeric( $val ) ? $val : "'" . $val . "'";
393	369	$clause = array( $field, $operator, $val );
394	370	break;
395	371	}
396	372	} elseif ( is_array( $value ) ) {
		@@ -395,10 +371,11 @@
395	371	}
396	372	} elseif ( is_array( $value ) ) {
397	373	$clause = array( $field, 'IN', $value );
398	374	} elseif ( 'null' === strtolower( $value ) ) {
399		- $clause = array( $field, 'IS', 'NULL' );
	375	+ $clause = array( $field, 'IS', 'NULL' );
400	376	} else {
	377	+ $value = is_numeric( $value ) ? $value : "'" . $value . "'";
401	378	$clause = array( $field, '=', $value );
402	379	}
403	380
404	381	$arr[] = ( 'RAW' === $operator ) ? $clause : self::make_clause( $clause );
		@@ -499,11 +476,11 @@
499	476	global $wpdb;
500	477	$ids = $wpdb->get_col( "SELECT comment_id FROM {$wpdb->comments} WHERE {$where}" );//phpcs:ignore
501	478
502	479	if ( is_array( $ids ) && count( $ids ) ) {
503		- $in_clause = self::prepare_in_clause( $ids );
	480	+ $ids_str = "'" . implode( "','", $ids ) . "'";
504	481	// delete comment metas.
505		- $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->commentmeta} WHERE comment_id IN({$in_clause}) " ) );//phpcs:ignore
	482	+ $wpdb->query( "DELETE FROM {$wpdb->commentmeta} WHERE comment_id IN({$ids_str}) " );//phpcs:ignore
506	483	// delete comment.
507	484	$wpdb->query( "DELETE FROM {$wpdb->comments} WHERE {$where}" );//phpcs:ignore
508	485
509	486	return true;
		@@ -531,11 +508,11 @@
531	508	global $wpdb;
532	509	$ids = $wpdb->get_col( "SELECT id FROM {$wpdb->posts} WHERE {$where}" );//phpcs:ignore
533	510
534	511	if ( is_array( $ids ) && count( $ids ) ) {
535		- $in_clause = self::prepare_in_clause( $ids );
	512	+ $ids_str = "'" . implode( "','", $ids ) . "'";
536	513	// delete post metas.
537		- $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->postmeta} WHERE post_id IN({$in_clause}) " ) );//phpcs:ignore
	514	+ $wpdb->query( "DELETE FROM {$wpdb->postmeta} WHERE post_id IN({$ids_str}) " );//phpcs:ignore
538	515	// delete post.
539	516	$wpdb->query( "DELETE FROM {$wpdb->posts} WHERE {$where}" );//phpcs:ignore
540	517
541	518	return true;
		@@ -846,12 +823,8 @@
846	823	global $wpdb;
847	824
848	825	$table = self::prepare_table_name( $table );
849	826	$where_clause = self::prepare_where_clause( $where );
850		- if ( ! empty( $where_clause ) ) {
851		- $where_clause = "WHERE {$where_clause}";
852		- }
853		-
854	827	$limit = (int) sanitize_text_field( $limit );
855	828	$limit_clause = ( -1 === $limit ) ? '' : 'LIMIT ' . $limit;
856	829
857	830	//phpcs:disable
		@@ -856,9 +829,9 @@
856	829
857	830	//phpcs:disable
858	831	$query = "SELECT *
859	832	FROM {$table}
860		- {$where_clause}
	833	+ WHERE {$where_clause}
861	834	ORDER BY {$order_by} {$order}
862	835	{$limit_clause}";
863	836
864	837	return $wpdb->get_results(
		@@ -937,42 +910,33 @@
937	910	return rtrim( $set, ',' );
938	911	}
939	912
940	913	/**
941		- * Prepare value before using in query.
942		- *
943		- * @since 3.9.7
944		- *
945		- * @param string|int|float $value the value to prepare.
946		- *
947		- * @return mixed
948		- */
949		- public static function prepare_value( $value ) {
950		- global $wpdb;
951		- $escaped_value = null;
952		- if ( is_int( $value ) ) {
953		- $escaped_value = $wpdb->prepare( '%d', $value );
954		- } elseif ( is_float( $value ) ) {
955		- list( $whole, $decimal ) = explode( '.', $value );
956		- $expression = '%.'. strlen( $decimal ) . 'f';
957		- $escaped_value = $wpdb->prepare( $expression, $value );
958		- } else {
959		- $escaped_value = $wpdb->prepare( '%s', $value );
960		- }
961		- return $escaped_value;
962		- }
963		-
964		- /**
965	914	* Make sanitized SQL IN clause value from an array
966	915	*
967		- * @since 2.1.1
968		- *
969	916	* @param array $arr a sequential array.
970		- *
971	917	* @return string
	918	+ * @since 2.1.1
972	919	*/
973	920	public static function prepare_in_clause( array $arr ) {
974		- $escaped = array_map( fn( $value ) => self::prepare_value( $value ), $arr );
	921	+ $escaped = array_map(
	922	+ function( $value ) {
	923	+ global $wpdb;
	924	+ $escaped_value = null;
	925	+ if ( is_int( $value ) ) {
	926	+ $escaped_value = $wpdb->prepare( '%d', $value );
	927	+ } else if( is_float( $value ) ) {
	928	+ list( $whole, $decimal ) = explode( '.', $value );
	929	+ $expression = '%.'. strlen( $decimal ) . 'f';
	930	+ $escaped_value = $wpdb->prepare( $expression, $value );
	931	+ } else {
	932	+ $escaped_value = $wpdb->prepare( '%s', $value );
	933	+ }
	934	+ return $escaped_value;
	935	+ },
	936	+ $arr
	937	+ );
	938	+
975	939	return implode( ',', $escaped );
976	940	}
977	941
978	942	/**
		@@ -1230,9 +1194,9 @@
1230	1194	case 'today':
1231	1195	$period_clause = "AND DATE($column) = CURDATE()";
1232	1196	break;
1233	1197	case 'monthly':
1234		- $period_clause = "AND MONTH($column) = MONTH(CURDATE()) AND YEAR($column) = YEAR(CURDATE())";
	1198	+ $period_clause = "AND MONTH($column) = MONTH(CURDATE())";
1235	1199	break;
1236	1200	case 'yearly':
1237	1201	$period_clause = "AND YEAR($column) = YEAR(CURDATE())";
1238	1202	break;
		@@ -1383,9 +1347,8 @@
1383	1347	// If error occurred then throw new exception.
1384	1348	if ($wpdb->last_error) {
1385	1349	throw new \Exception($wpdb->last_error);
1386	1350	}
1387		-
1388	1351
1389	1352	return $result;
1390	1353	}
1391	1354