← All changes | classes/Dashboard/DBManager.php +71 -24 3.4 → 4.3 View file →

		@@ -1,5 +1,24 @@
1	1	<?php
	2	+/**
	3	+ * DBManager class for WP Coder plugin.
	4	+ *
	5	+ * @package WPCoder\Admin
	6	+ *
	7	+ * Methods:
	8	+ * - create() Create database table
	9	+ * - get_columns() Get table column structure
	10	+ * - insert() Insert new row
	11	+ * - update() Update existing row
	12	+ * - delete() Delete row by ID
	13	+ * - remove_item() Handle item removal from GET request
	14	+ * - get_all_data() Get all rows from table
	15	+ * - get_data_by_id() Get single row by ID
	16	+ * - get_data_by_title() Get row by title
	17	+ * - check_row() Check if row exists by ID
	18	+ * - get_tags_from_table() Get unique tags
	19	+ * - display_tags() Output HTML <option> tags for tags
	20	+ */
2	21
3	22	namespace WPCoder\Dashboard;
4	23
5	24	defined( 'ABSPATH' ) || exit;
		@@ -8,12 +27,13 @@
8	27
9	28	class DBManager {
10	29
11	30	public static function remove_item() {
12		- $page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : '';
13		- $action = isset( $_GET['action'] ) ? sanitize_text_field( $_GET['action'] ) : '';
	31	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
	32	+ $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
	33	+ $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
14	34	$id = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : '';
15		-
	35	+ // phpcs:enable
16	36	if ( ( $page !== WPCoder::SLUG ) || ( $action !== 'delete' ) || empty( $id ) ) {
17	37	return false;
18	38	}
19	39
		@@ -41,26 +61,15 @@
41	61
42	62	return $wpdb->delete( $table, [ 'id' => $id ], [ '%d' ] );
43	63	}
44	64
45		- public static function create(): void {
	65	+ public static function create( $columns ): void {
46	66	global $wpdb;
47		- $table_name = $wpdb->prefix . WPCoder::PREFIX;
	67	+ $table = $wpdb->prefix . WPCoder::PREFIX;
48	68	$charset_collate = $wpdb->get_charset_collate();
49	69
50		- $sql = "CREATE TABLE $table_name (
51		- id mediumint(9) NOT NULL AUTO_INCREMENT,
52		- title VARCHAR(200) NOT NULL,
53		- html_code LONGTEXT,
54		- css_code LONGTEXT,
55		- js_code LONGTEXT,
56		- php_code LONGTEXT,
57		- param LONGTEXT,
58		- status BOOLEAN,
59		- mode BOOLEAN,
60		- tag TEXT,
61		- PRIMARY KEY (id)
62		- ) $charset_collate;";
	70	+ $sql = "CREATE TABLE $table ($columns) $charset_collate;";
	71	+
63	72	require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
64	73	dbDelta( $sql );
65	74	}
66	75
		@@ -71,19 +80,57 @@
71	80
72	81	return ! empty( $result ) ? $result : false;
73	82	}
74	83
	84	+ public static function get_data_by_tag( $tag = '' ) {
	85	+ if ( empty( $tag ) ) {
	86	+ return false;
	87	+ }
	88	+
	89	+ global $wpdb;
	90	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	91	+ $query = $wpdb->prepare( "SELECT * FROM {$table} WHERE tag = %s ORDER BY id ASC", sanitize_text_field( $tag ) );
	92	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	93	+
	94	+ return ! empty( $result ) ? $result : false;
	95	+ }
	96	+
75	97	public static function get_data_by_id( $id = '' ) {
76	98	if ( empty( $id ) ) {
77	99	return false;
78	100	}
79	101	global $wpdb;
80		- $table = $wpdb->prefix . WPCoder::PREFIX;
81		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) );
	102	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
82	103
83		- return $wpdb->get_row( $query );
	104	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	105	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) ) );
84	106	}
85	107
	108	+ public static function get_data_by_ids( $ids = [] ) {
	109	+ if ( empty( $ids ) || ! is_array( $ids ) ) {
	110	+ return false;
	111	+ }
	112	+
	113	+ global $wpdb;
	114	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	115	+
	116	+ $ids = array_filter( array_map( 'absint', $ids ) );
	117	+
	118	+ if ( empty( $ids ) ) {
	119	+ return false;
	120	+ }
	121	+
	122	+ $placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
	123	+ $query = $wpdb->prepare(
	124	+ "SELECT * FROM {$table} WHERE id IN ($placeholders)",
	125	+ ...$ids
	126	+ );
	127	+
	128	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	129	+
	130	+ return ! empty( $result ) ? $result : false;
	131	+ }
	132	+
86	133	public static function get_data_by_title( $title = '' ) {
87	134	if ( empty( $title ) ) {
88	135	return false;
89	136	}
		@@ -88,12 +135,12 @@
88	135	return false;
89	136	}
90	137
91	138	global $wpdb;
92		- $table = $wpdb->prefix . WPCoder::PREFIX;
93		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", sanitize_text_field( $title ) );
	139	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
94	140
95		- return $wpdb->get_row( $query );
	141	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	142	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", esc_attr( $title ) ) );
96	143	}
97	144
98	145	public static function update( $data, $where, $data_formats ): void {
99	146	if ( ! current_user_can( 'unfiltered_html' ) ) {