← All changes | classes/Dashboard/DBManager.php +83 -26 3.0.2 → 4.5 View file →

		@@ -1,25 +1,45 @@
1	1	<?php
	2	+/**
	3	+ * DBManager class for WP Coder plugin.
	4	+ *
	5	+ * @package WPCoder\Admin
	6	+ *
	7	+ * Methods:
	8	+ * - create() Create database table
	9	+ * - get_columns() Get table column structure
	10	+ * - insert() Insert new row
	11	+ * - update() Update existing row
	12	+ * - delete() Delete row by ID
	13	+ * - remove_item() Handle item removal from GET request
	14	+ * - get_all_data() Get all rows from table
	15	+ * - get_data_by_id() Get single row by ID
	16	+ * - get_data_by_title() Get row by title
	17	+ * - check_row() Check if row exists by ID
	18	+ * - get_tags_from_table() Get unique tags
	19	+ * - display_tags() Output HTML <option> tags for tags
	20	+ */
2	21
3	22	namespace WPCoder\Dashboard;
4	23
5	24	defined( 'ABSPATH' ) || exit;
6	25
7		-use WPCoder\WOW_Plugin;
	26	+use WPCoder\WPCoder;
8	27
9	28	class DBManager {
10	29
11	30	public static function remove_item() {
12		- $page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : '';
13		- $action = isset( $_GET['action'] ) ? sanitize_text_field( $_GET['action'] ) : '';
	31	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended
	32	+ $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
	33	+ $action = isset( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
14	34	$id = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : '';
15		-
16		- if ( ( $page !== WOW_Plugin::SLUG ) || ( $action !== 'delete' ) || empty( $id ) ) {
	35	+ // phpcs:enable
	36	+ if ( ( $page !== WPCoder::SLUG ) || ( $action !== 'delete' ) || empty( $id ) ) {
17	37	return false;
18	38	}
19	39
20	40	global $wpdb;
21		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	41	+ $table = $wpdb->prefix . WPCoder::PREFIX;
22	42
23	43	$result = $wpdb->delete( $table, [ 'id' => $id ], [ '%d' ] );
24	44
25	45	if ( $result ) {
		@@ -36,9 +56,9 @@
36	56	return false;
37	57	}
38	58
39	59	global $wpdb;
40		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	60	+ $table = $wpdb->prefix . WPCoder::PREFIX;
41	61
42	62	return $wpdb->delete( $table, [ 'id' => $id ], [ '%d' ] );
43	63	}
44	64
		@@ -43,11 +63,12 @@
43	63	}
44	64
45	65	public static function create( $columns ): void {
46	66	global $wpdb;
47		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	67	+ $table = $wpdb->prefix . WPCoder::PREFIX;
	68	+ $charset_collate = $wpdb->get_charset_collate();
48	69
49		- $sql = "CREATE TABLE IF NOT EXISTS $table ($columns) DEFAULT CHARACTER SET {$wpdb->charset} COLLATE {$wpdb->collate};";
	70	+ $sql = "CREATE TABLE $table ($columns) $charset_collate;";
50	71
51	72	require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
52	73	dbDelta( $sql );
53	74	}
		@@ -53,25 +74,63 @@
53	74	}
54	75
55	76	public static function get_all_data() {
56	77	global $wpdb;
57		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	78	+ $table = $wpdb->prefix . WPCoder::PREFIX;
58	79	$result = $wpdb->get_results( "SELECT * FROM $table ORDER BY id ASC" );
59	80
60	81	return ! empty( $result ) ? $result : false;
61	82	}
62	83
	84	+ public static function get_data_by_tag( $tag = '' ) {
	85	+ if ( empty( $tag ) ) {
	86	+ return false;
	87	+ }
	88	+
	89	+ global $wpdb;
	90	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	91	+ $query = $wpdb->prepare( "SELECT * FROM {$table} WHERE tag = %s ORDER BY id ASC", sanitize_text_field( $tag ) );
	92	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	93	+
	94	+ return ! empty( $result ) ? $result : false;
	95	+ }
	96	+
63	97	public static function get_data_by_id( $id = '' ) {
64	98	if ( empty( $id ) ) {
65	99	return false;
66	100	}
67	101	global $wpdb;
68		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
69		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) );
	102	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
70	103
71		- return $wpdb->get_row( $query );
	104	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	105	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE id=%d", absint( $id ) ) );
72	106	}
73	107
	108	+ public static function get_data_by_ids( $ids = [] ) {
	109	+ if ( empty( $ids ) || ! is_array( $ids ) ) {
	110	+ return false;
	111	+ }
	112	+
	113	+ global $wpdb;
	114	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
	115	+
	116	+ $ids = array_filter( array_map( 'absint', $ids ) );
	117	+
	118	+ if ( empty( $ids ) ) {
	119	+ return false;
	120	+ }
	121	+
	122	+ $placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
	123	+ $query = $wpdb->prepare(
	124	+ "SELECT * FROM {$table} WHERE id IN ($placeholders)",
	125	+ ...$ids
	126	+ );
	127	+
	128	+ $result = $wpdb->get_results( $query ); // phpcs:ignore WordPress.DB.*
	129	+
	130	+ return ! empty( $result ) ? $result : false;
	131	+ }
	132	+
74	133	public static function get_data_by_title( $title = '' ) {
75	134	if ( empty( $title ) ) {
76	135	return false;
77	136	}
		@@ -76,34 +135,32 @@
76	135	return false;
77	136	}
78	137
79	138	global $wpdb;
80		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
81		- $query = $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", sanitize_text_field( $title ) );
	139	+ $table = esc_sql( $wpdb->prefix . WPCoder::PREFIX );
82	140
83		- return $wpdb->get_row( $query );
	141	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	142	+ return $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $table WHERE title=%s", esc_attr( $title ) ) );
84	143	}
85	144
86	145	public static function update( $data, $where, $data_formats ): void {
87		- if(! current_user_can( 'unfiltered_html' )) {
	146	+ if ( ! current_user_can( 'unfiltered_html' ) ) {
88	147	return;
89	148	}
90	149
91	150	global $wpdb;
92		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	151	+ $table = $wpdb->prefix . WPCoder::PREFIX;
93	152	$result = $wpdb->update( $table, $data, $where, $data_formats );
94	153	}
95	154
96	155	public static function insert( $data, $data_formats ) {
97		-
98		- if(! current_user_can( 'unfiltered_html' )) {
	156	+ if ( ! current_user_can( 'unfiltered_html' ) ) {
99	157	return false;
100	158	}
101	159
102	160	global $wpdb;
103		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	161	+ $table = $wpdb->prefix . WPCoder::PREFIX;
104	162
105		-
106	163	$result = $wpdb->insert( $table, $data, $data_formats );
107	164
108	165	if ( $result ) {
109	166	return $wpdb->insert_id;
		@@ -113,9 +170,9 @@
113	170	}
114	171
115	172	public static function check_row( $id = '' ): bool {
116	173	global $wpdb;
117		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	174	+ $table = $wpdb->prefix . WPCoder::PREFIX;
118	175	if ( empty( $id ) ) {
119	176	return false;
120	177	}
121	178
		@@ -128,9 +185,9 @@
128	185	}
129	186
130	187	public static function get_columns() {
131	188	global $wpdb;
132		- $table_name = $wpdb->prefix . WOW_Plugin::PREFIX;
	189	+ $table_name = $wpdb->prefix . WPCoder::PREFIX;
133	190
134	191	return $wpdb->get_results( "DESCRIBE $table_name" );
135	192	}
136	193
		@@ -135,9 +192,9 @@
135	192	}
136	193
137	194	public static function display_tags(): void {
138	195	global $wpdb;
139		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	196	+ $table = $wpdb->prefix . WPCoder::PREFIX;
140	197	$result = $wpdb->get_results( "SELECT * FROM $table order by tag desc", ARRAY_A );
141	198	$tags = [];
142	199	if ( ! empty( $result ) ) {
143	200	foreach ( $result as $column ) {
		@@ -154,9 +211,9 @@
154	211	}
155	212
156	213	public static function get_tags_from_table() {
157	214	global $wpdb;
158		- $table = $wpdb->prefix . WOW_Plugin::PREFIX;
	215	+ $table = $wpdb->prefix . WPCoder::PREFIX;
159	216	$all_tags = $wpdb->get_results( "SELECT DISTINCT tag FROM $table ORDER BY tag ASC", ARRAY_A );
160	217
161	218	return ! empty( $all_tags ) ? $all_tags : false;
162	219	}