Ticket #7171: 7171.diff

wp-includes/wp-db.php

@@ -106 +106 @@
         var $col_info;
 
         /**
+         * Saved info on the table columns
+         *
+         * @since 2.7.0
+         * @access private
+         * @var array
+         */
+        var $column_types = array();
+
+        /**
          * Saved queries that were executed
          *
          * @since 1.5.0
@@ -629 +638 @@
                         $i = 0;
                         while ($i < @mysql_num_fields($this->result)) {
                                 $this->col_info[$i] = @mysql_fetch_field($this->result);
+                                $this->column_types[ $this->col_info[$i]->table ][ $this->col_info[$i]->name ] = $this->col_info[$i]->type;
                                 $i++;
                         }
                         $num_rows = 0;
@@ -659 +669 @@
          * @return mixed Results of $this->query()
          */
         function insert($table, $data) {
-                $data = add_magic_quotes($data);
                 $fields = array_keys($data);
-                return $this->query("INSERT INTO $table (`" . implode('`,`',$fields) . "`) VALUES ('".implode("','",$data)."')");
+
+                $insertfields = $insertfieldtypes = $prepbits = array();
+
+                $types = $this->prepare_columns($table, $keys = array_keys($data));
+
+                foreach( (array)$data as $field => $piece ) {
+                        $insertfields[] = $field;
+                        $insertfieldtypes[] = $types[$field];
+                        $prepbits[] = $piece;
+                }
+
+                $sql = 'INSERT INTO ' . $table;
+                $sql .= ' (`' . implode('`,`', $insertfields) . '`)';
+                $sql .= ' VALUES (' . implode(',', $insertfieldtypes) . ')';
+
+                $sql = call_user_func_array(array(&$this, 'prepare'), array_merge(array($sql), $prepbits));
+
+                return $this->query( $sql );
         }
 
         /**
@@ -675 +701 @@
          * @return mixed Results of $this->query()
          */
         function update($table, $data, $where){
-                $data = add_magic_quotes($data);
-                $bits = $wheres = array();
-                foreach ( (array) array_keys($data) as $k )
-                        $bits[] = "`$k` = '$data[$k]'";
+                if ( empty($table) || empty($where) )
+                        return;
 
-                if ( is_array( $where ) )
-                        foreach ( $where as $c => $v )
-                                $wheres[] = "$c = '" . $this->escape( $v ) . "'";
-                else
-                        return false;
+                $bits = $wheres = $prepbits = array();
 
-                return $this->query( "UPDATE $table SET " . implode( ', ', $bits ) . ' WHERE ' . implode( ' AND ', $wheres ) );
+                $sql = "UPDATE $table SET ";
+
+                $types = $this->prepare_columns($table, array_merge(array_keys($data), array_keys($where)) );
+
+                foreach ( array_keys($data) as $k ) {
+                        $bits[] = "`$k` = " . $types[$k];
+                        $prepbits[] = $data[$k];
+                }
+
+                $sql .= implode( ', ', $bits );
+                
+                $sql .= ' WHERE ';
+
+                foreach ( array_keys($where) as $k ) {
+                        $wheres[] = "`$k` = " . $types[$k];
+                        $prepbits[] = $where[$k];                       
+                }
+                $sql .= implode( ' AND ', $wheres );
+
+                $sql = call_user_func_array(array(&$this, 'prepare'), array_merge(array($sql), $prepbits));
+
+                return $this->query( $sql );
         }
 
         /**
+         * Determines a table column type sprintf()-style token
+         *
+         * Uses values cached from the previous queries,
+         * Loads any column types with a simple SELECT .. LIMIT 1 of any fields which are not allready loaded.
+         *
+         * @param string $table WARNING: not sanitized!
+         * @param array $cols array of columns to prepare. WARNING: not sanitized!
+         * @return array of key => value pairs of field => token
+         */
+        function prepare_columns($table, $cols) {
+                //Load any columns which are not allready cached.
+                $load_cols = array();
+                foreach ( (array) $cols as $col )
+                        if ( ! isset($this->column_types[$table][$col]) )
+                                $load_cols[] = $col;
+
+                if ( !empty($load_cols) ) {
+                        $load_cols = implode('`,`', $load_cols);
+                        $this->query("SELECT `$load_cols` FROM $table LIMIT 1");
+                }
+
+                $return = array();
+                foreach ( (array) $cols as $col ) {
+                        switch ( $this->column_types[$table][$col] ) {
+                                case 'int':
+                                        $return[$col] = '%d';
+                                        break;
+                                case 'real':
+                                        $return[$col] = '%f';
+                                        break;
+                                case 'date':
+                                case 'datetime':
+                                case 'string':
+                                case 'blob':
+                                default:
+                                        $return[$col] = '%s';
+                                        break;
+                        }
+                }
+                return $return;
+        }
+
+        /**
          * Retrieve one variable from the database.
          *
          * This combines the functionality of wpdb::get_row() and wpdb::get_col(),
@@ -900 +984 @@
          *
          * @return WP_Error
          */
-        function check_database_version()
-        {
+        function check_database_version() {
                 global $wp_version;
                 // Make sure the server has MySQL 4.0
                 if ( version_compare($this->db_version(), '4.0.0', '<') )
@@ -917 +1000 @@
          *
          * @return bool True if collation is supported, false if version does not
          */
-        function supports_collation()
-        {
+        function supports_collation() {
                 return $this->has_cap( 'collation' );
         }