← All changes | classes/Dashboard/DBManager.php +89 -25 3.0 → 4.2 View file →

		@@ -1,25 +1,45 @@
1	1	<?php
	2	+/**
	3	+ * DBManager class for WP Coder plugin.
	4	+ *
	5	+ * @package WPCoder\Admin
	6	+ *
	7	+ * Methods:
	8	+ * - create() Create database table
	9	+ * - get_columns() Get table column structure
	10	+ * - insert() Insert new row
	11	+ * - update() Update existing row
	12	+ * - delete() Delete row by ID
	13	+ * - remove_item() Handle item removal from GET request
	14	+ * - get_all_data() Get all rows from table
	15	+ * - get_data_by_id() Get single row by ID
	16	+ * - get_data_by_title() Get row by title
	17	+ * - check_row() Check if row exists by ID
	18	+ * - get_tags_from_table() Get unique tags
	19	+ * - display_tags() Output HTML <option> tags for tags
	20	+ */
2	21
3	22	namespace WPCoder\Dashboard;
4	23
5	24	defined( 'ABSPATH' ) || exit;
6	25
7		-use WPCoder\WOW_Plugin;
	26	+use WPCoder\WPCoder;
8	27
9	28	class DBManager {
10	29
11	30	public static function remove_item() {
12		- $page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : '';
13		- $action = isset( $_GET['action'] ) ? sanitize_text_field( $_GET['action'] ) : '';
	31	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
	32	+ $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
	33	+ $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
14	34	$id = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : '';
15		-
16		- if ( ( $page !== WOW_Plugin::SLUG ) || ( $action !== 'delete' ) || empty( $id ) ) {
	35	+ // phpcs:enable
	36	+ if ( ( $page !== WPCoder::SLUG ) || ( $action !== 'delete' ) || empty( $id ) ) {
17	37	return false;
18	38	}
19	39
20	40	global $wpdb;
21		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	41	+ $table = $wpdb->prefix . WPCoder::PREFIX;
22	42
23	43	$result = $wpdb->delete( $table, [ 'id' => $id ], [ '%d' ] );
24	44
25	45	if ( $result ) {
		@@ -36,20 +56,19 @@
36	56	return false;
37	57	}
38	58
39	59	global $wpdb;
40		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	60	+ $table = $wpdb->prefix . WPCoder::PREFIX;
41	61
42	62	return $wpdb->delete( $table, [ 'id' => $id ], [ '%d' ] );
43		-
44	63	}
45	64
46	65	public static function create( $columns ): void {
47		-
48	66	global $wpdb;
49		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	67	+ $table = $wpdb->prefix . WPCoder::PREFIX;
	68	+ $charset_collate = $wpdb->get_charset_collate();
50	69
51		- $sql = "CREATE TABLE IF NOT EXISTS $table ($columns) DEFAULT CHARACTER SET {$wpdb->charset} COLLATE {$wpdb->collate};";
	70	+ $sql = "CREATE TABLE $table ($columns) $charset_collate;";
52	71
53	72	require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
54	73	dbDelta( $sql );
55	74	}
		@@ -55,25 +74,63 @@
55	74	}
56	75
57	76	public static function get_all_data() {
58	77	global $wpdb;
59		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	78	+ $table = $wpdb->prefix . WPCoder::PREFIX;
60	79	$result = $wpdb->get_results( "SELECT * FROM $table ORDER BY id ASC" );
61	80
62	81	return ! empty( $result ) ? $result : false;
63	82	}
64	83
	84	+ public static function get_data_by_tag( $tag = '' ) {
	85	+ if ( empty( $tag ) ) {
	86	+ return false;
	87	+ }
	88	+
	89	+ global $wpdb;
	90	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	91	+ $query = $wpdb->prepare( "SELECT * FROM {$table} WHERE tag = %s ORDER BY id ASC", sanitize_text_field( $tag ) );
	92	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	93	+
	94	+ return ! empty( $result ) ? $result : false;
	95	+ }
	96	+
65	97	public static function get_data_by_id( $id = '' ) {
66	98	if ( empty( $id ) ) {
67	99	return false;
68	100	}
69	101	global $wpdb;
70		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
71		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) );
	102	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
72	103
73		- return $wpdb->get_row( $query );
	104	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	105	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) ) );
74	106	}
75	107
	108	+ public static function get_data_by_ids( $ids = [] ) {
	109	+ if ( empty( $ids ) || ! is_array( $ids ) ) {
	110	+ return false;
	111	+ }
	112	+
	113	+ global $wpdb;
	114	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	115	+
	116	+ $ids = array_filter( array_map( 'absint', $ids ) );
	117	+
	118	+ if ( empty( $ids ) ) {
	119	+ return false;
	120	+ }
	121	+
	122	+ $placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
	123	+ $query = $wpdb->prepare(
	124	+ "SELECT * FROM {$table} WHERE id IN ($placeholders)",
	125	+ ...$ids
	126	+ );
	127	+
	128	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	129	+
	130	+ return ! empty( $result ) ? $result : false;
	131	+ }
	132	+
76	133	public static function get_data_by_title( $title = '' ) {
77	134	if ( empty( $title ) ) {
78	135	return false;
79	136	}
		@@ -78,29 +135,36 @@
78	135	return false;
79	136	}
80	137
81	138	global $wpdb;
82		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
83		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", sanitize_text_field( $title ) );
	139	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
84	140
85		- return $wpdb->get_row( $query );
	141	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	142	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", esc_attr( $title ) ) );
86	143	}
87	144
88	145	public static function update( $data, $where, $data_formats ): void {
	146	+ if ( ! current_user_can( 'unfiltered_html' ) ) {
	147	+ return;
	148	+ }
	149	+
89	150	global $wpdb;
90		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	151	+ $table = $wpdb->prefix . WPCoder::PREFIX;
91	152	$result = $wpdb->update( $table, $data, $where, $data_formats );
92	153	}
93	154
94	155	public static function insert( $data, $data_formats ) {
	156	+ if ( ! current_user_can( 'unfiltered_html' ) ) {
	157	+ return false;
	158	+ }
	159	+
95	160	global $wpdb;
96		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	161	+ $table = $wpdb->prefix . WPCoder::PREFIX;
97	162
98	163	$result = $wpdb->insert( $table, $data, $data_formats );
99	164
100	165	if ( $result ) {
101	166	return $wpdb->insert_id;
102		-
103	167	}
104	168
105	169	return false;
106	170	}
		@@ -106,9 +170,9 @@
106	170	}
107	171
108	172	public static function check_row( $id = '' ): bool {
109	173	global $wpdb;
110		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	174	+ $table = $wpdb->prefix . WPCoder::PREFIX;
111	175	if ( empty( $id ) ) {
112	176	return false;
113	177	}
114	178
		@@ -121,9 +185,9 @@
121	185	}
122	186
123	187	public static function get_columns() {
124	188	global $wpdb;
125		- $table_name = $wpdb->prefix . WOW_Plugin::PREFIX;
	189	+ $table_name = $wpdb->prefix . WPCoder::PREFIX;
126	190
127	191	return $wpdb->get_results( "DESCRIBE $table_name" );
128	192	}
129	193
		@@ -128,9 +192,9 @@
128	192	}
129	193
130	194	public static function display_tags(): void {
131	195	global $wpdb;
132		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	196	+ $table = $wpdb->prefix . WPCoder::PREFIX;
133	197	$result = $wpdb->get_results( "SELECT * FROM $table order by tag desc", ARRAY_A );
134	198	$tags = [];
135	199	if ( ! empty( $result ) ) {
136	200	foreach ( $result as $column ) {
		@@ -147,9 +211,9 @@
147	211	}
148	212
149	213	public static function get_tags_from_table() {
150	214	global $wpdb;
151		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	215	+ $table = $wpdb->prefix . WPCoder::PREFIX;
152	216	$all_tags = $wpdb->get_results( "SELECT DISTINCT tag FROM $table ORDER BY tag ASC", ARRAY_A );
153	217
154	218	return ! empty( $all_tags ) ? $all_tags : false;
155	219	}