Changeset 42059 for branches/4.6/src/wp-includes/wp-db.php
- Timestamp:
- 10/31/2017 12:40:24 PM (7 years ago)
- Location:
- branches/4.6
- Files:
-
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/4.6
- Property svn:mergeinfo changed
/trunk merged: 41662,42056
- Property svn:mergeinfo changed
-
branches/4.6/src/wp-includes/wp-db.php
r41499 r42059 1169 1169 if ( $this->dbh ) { 1170 1170 if ( $this->use_mysqli ) { 1171 returnmysqli_real_escape_string( $this->dbh, $string );1171 $escaped = mysqli_real_escape_string( $this->dbh, $string ); 1172 1172 } else { 1173 return mysql_real_escape_string( $string, $this->dbh ); 1174 } 1175 } 1176 1177 $class = get_class( $this ); 1178 if ( function_exists( '__' ) ) { 1179 /* translators: %s: database access abstraction class, usually wpdb or a class extending wpdb */ 1180 _doing_it_wrong( $class, sprintf( __( '%s must set a database connection for use with escaping.' ), $class ), '3.6.0' ); 1173 $escaped = mysql_real_escape_string( $string, $this->dbh ); 1174 } 1181 1175 } else { 1182 _doing_it_wrong( $class, sprintf( '%s must set a database connection for use with escaping.', $class ), '3.6.0' ); 1183 } 1184 return addslashes( $string ); 1176 $class = get_class( $this ); 1177 if ( function_exists( '__' ) ) { 1178 /* translators: %s: database access abstraction class, usually wpdb or a class extending wpdb */ 1179 _doing_it_wrong( $class, sprintf( __( '%s must set a database connection for use with escaping.' ), $class ), '3.6.0' ); 1180 } else { 1181 _doing_it_wrong( $class, sprintf( '%s must set a database connection for use with escaping.', $class ), '3.6.0' ); 1182 } 1183 $escaped = addslashes( $string ); 1184 } 1185 1186 return $this->add_placeholder_escape( $escaped ); 1185 1187 } 1186 1188 … … 1257 1259 * Prepares a SQL query for safe execution. Uses sprintf()-like syntax. 1258 1260 * 1259 * The following directives can be used in the query formatstring:1261 * The following placeholders can be used in the query string: 1260 1262 * %d (integer) 1261 1263 * %f (float) 1262 1264 * %s (string) 1263 * %% (literal percentage sign - no argument needed) 1264 * 1265 * All of %d, %f, and %s are to be left unquoted in the query string and they need an argument passed for them. 1266 * Literals (%) as parts of the query must be properly written as %%. 1267 * 1268 * This function only supports a small subset of the sprintf syntax; it only supports %d (integer), %f (float), and %s (string). 1269 * Does not support sign, padding, alignment, width or precision specifiers. 1270 * Does not support argument numbering/swapping. 1271 * 1272 * May be called like {@link https://secure.php.net/sprintf sprintf()} or like {@link https://secure.php.net/vsprintf vsprintf()}. 1273 * 1274 * Both %d and %s should be left unquoted in the query string. 1275 * 1276 * wpdb::prepare( "SELECT * FROM `table` WHERE `column` = %s AND `field` = %d", 'foo', 1337 ) 1277 * wpdb::prepare( "SELECT DATE_FORMAT(`field`, '%%c') FROM `table` WHERE `column` = %s", 'foo' ); 1265 * 1266 * All placeholders MUST be left unquoted in the query string. A corresponding argument MUST be passed for each placeholder. 1267 * 1268 * For compatibility with old behavior, numbered or formatted string placeholders (eg, %1$s, %5s) will not have quotes 1269 * added by this function, so should be passed with appropriate quotes around them for your usage. 1270 * 1271 * Literal percentage signs (%) in the query string must be written as %%. Percentage wildcards (for example, 1272 * to use in LIKE syntax) must be passed via a substitution argument containing the complete LIKE string, these 1273 * cannot be inserted directly in the query string. Also see {@see esc_like()}. 1274 * 1275 * Arguments may be passed as individual arguments to the method, or as a single array containing all arguments. A combination 1276 * of the two is not supported. 1277 * 1278 * Examples: 1279 * $wpdb->prepare( "SELECT * FROM `table` WHERE `column` = %s AND `field` = %d OR `other_field` LIKE %s", array( 'foo', 1337, '%bar' ) ); 1280 * $wpdb->prepare( "SELECT DATE_FORMAT(`field`, '%%c') FROM `table` WHERE `column` = %s", 'foo' ); 1278 1281 * 1279 1282 * @link https://secure.php.net/sprintf Description of syntax. … … 1281 1284 * 1282 1285 * @param string $query Query statement with sprintf()-like placeholders 1283 * @param array|mixed $args The array of variables to substitute into the query's placeholders if being called like 1284 * {@link https://secure.php.net/vsprintf vsprintf()}, or the first variable to substitute into the query's placeholders if 1285 * being called like {@link https://secure.php.net/sprintf sprintf()}. 1286 * @param mixed $args,... further variables to substitute into the query's placeholders if being called like 1287 * {@link https://secure.php.net/sprintf sprintf()}. 1286 * @param array|mixed $args The array of variables to substitute into the query's placeholders if being called with an array of arguments, 1287 * or the first variable to substitute into the query's placeholders if being called with individual arguments. 1288 * @param mixed $args,... further variables to substitute into the query's placeholders if being called wih individual arguments. 1288 1289 * @return string|void Sanitized query string, if there is a query to prepare. 1289 1290 */ 1290 1291 public function prepare( $query, $args ) { 1291 if ( is_null( $query ) ) 1292 if ( is_null( $query ) ) { 1292 1293 return; 1294 } 1293 1295 1294 1296 // This is not meant to be foolproof -- but it will catch obviously incorrect usage. 1295 1297 if ( strpos( $query, '%' ) === false ) { 1298 wp_load_translations_early(); 1296 1299 _doing_it_wrong( 'wpdb::prepare', sprintf( __( 'The query argument of %s must have a placeholder.' ), 'wpdb::prepare()' ), '3.9.0' ); 1297 1300 } … … 1300 1303 array_shift( $args ); 1301 1304 1302 // If args were passed as an array (as in vsprintf), move them up 1305 // If args were passed as an array (as in vsprintf), move them up. 1306 $passed_as_array = false; 1303 1307 if ( is_array( $args[0] ) && count( $args ) == 1 ) { 1308 $passed_as_array = true; 1304 1309 $args = $args[0]; 1305 1310 } … … 1307 1312 foreach ( $args as $arg ) { 1308 1313 if ( ! is_scalar( $arg ) && ! is_null( $arg ) ) { 1309 _doing_it_wrong( 'wpdb::prepare', sprintf( 'Unsupported value type (%s).', gettype( $arg ) ), '4.6.7' ); 1310 } 1311 } 1312 1313 $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it 1314 $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting 1315 $query = preg_replace( '|(?<!%)%f|' , '%F', $query ); // Force floats to be locale unaware 1316 $query = preg_replace( '|(?<!%)%s|', "'%s'", $query ); // quote the strings, avoiding escaped strings like %%s 1317 $query = preg_replace( '/%(?:%|$|([^dsF]))/', '%%\\1', $query ); // escape any unescaped percents 1314 wp_load_translations_early(); 1315 _doing_it_wrong( 'wpdb::prepare', sprintf( __( 'Unsupported value type (%s).' ), gettype( $arg ) ), '4.8.2' ); 1316 } 1317 } 1318 1319 /* 1320 * Specify the formatting allowed in a placeholder. The following are allowed: 1321 * 1322 * - Sign specifier. eg, $+d 1323 * - Numbered placeholders. eg, %1$s 1324 * - Padding specifier, including custom padding characters. eg, %05s, %'#5s 1325 * - Alignment specifier. eg, %05-s 1326 * - Precision specifier. eg, %.2f 1327 */ 1328 $allowed_format = '(?:[1-9][0-9]*[$])?[-+0-9]*(?: |0|\'.)?[-+0-9]*(?:\.[0-9]+)?'; 1329 1330 /* 1331 * If a %s placeholder already has quotes around it, removing the existing quotes and re-inserting them 1332 * ensures the quotes are consistent. 1333 * 1334 * For backwards compatibility, this is only applied to %s, and not to placeholders like %1$s, which are frequently 1335 * used in the middle of longer strings, or as table name placeholders. 1336 */ 1337 $query = str_replace( "'%s'", '%s', $query ); // Strip any existing single quotes. 1338 $query = str_replace( '"%s"', '%s', $query ); // Strip any existing double quotes. 1339 $query = preg_replace( '/(?<!%)%s/', "'%s'", $query ); // Quote the strings, avoiding escaped strings like %%s. 1340 1341 $query = preg_replace( "/(?<!%)(%($allowed_format)?f)/" , '%\\2F', $query ); // Force floats to be locale unaware. 1342 1343 $query = preg_replace( "/%(?:%|$|(?!($allowed_format)?[sdF]))/", '%%\\1', $query ); // Escape any unescaped percents. 1344 1345 // Count the number of valid placeholders in the query. 1346 $placeholders = preg_match_all( "/(^|[^%]|(%%)+)%($allowed_format)?[sdF]/", $query, $matches ); 1347 1348 if ( count( $args ) !== $placeholders ) { 1349 if ( 1 === $placeholders && $passed_as_array ) { 1350 // If the passed query only expected one argument, but the wrong number of arguments were sent as an array, bail. 1351 wp_load_translations_early(); 1352 _doing_it_wrong( 'wpdb::prepare', __( 'The query only expected one placeholder, but an array of multiple placeholders was sent.' ), '4.9.0' ); 1353 1354 return; 1355 } else { 1356 /* 1357 * If we don't have the right number of placeholders, but they were passed as individual arguments, 1358 * or we were expecting multiple arguments in an array, throw a warning. 1359 */ 1360 wp_load_translations_early(); 1361 _doing_it_wrong( 'wpdb::prepare', 1362 /* translators: 1: number of placeholders, 2: number of arguments passed */ 1363 sprintf( __( 'The query does not contain the correct number of placeholders (%1$d) for the number of arguments passed (%2$d).' ), 1364 $placeholders, 1365 count( $args ) ), 1366 '4.8.3' 1367 ); 1368 } 1369 } 1370 1318 1371 array_walk( $args, array( $this, 'escape_by_ref' ) ); 1319 return @vsprintf( $query, $args ); 1372 $query = @vsprintf( $query, $args ); 1373 1374 return $this->add_placeholder_escape( $query ); 1320 1375 } 1321 1376 … … 1890 1945 $this->queries[] = array( $query, $this->timer_stop(), $this->get_caller() ); 1891 1946 } 1947 } 1948 1949 /** 1950 * Generates and returns a placeholder escape string for use in queries returned by ::prepare(). 1951 * 1952 * @since 4.8.3 1953 * 1954 * @return string String to escape placeholders. 1955 */ 1956 public function placeholder_escape() { 1957 static $placeholder; 1958 1959 if ( ! $placeholder ) { 1960 // If ext/hash is not present, compat.php's hash_hmac() does not support sha256. 1961 $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1'; 1962 // Old WP installs may not have AUTH_SALT defined. 1963 $salt = defined( 'AUTH_SALT' ) ? AUTH_SALT : rand(); 1964 1965 $placeholder = '{' . hash_hmac( $algo, uniqid( $salt, true ), $salt ) . '}'; 1966 } 1967 1968 /* 1969 * Add the filter to remove the placeholder escaper. Uses priority 0, so that anything 1970 * else attached to this filter will recieve the query with the placeholder string removed. 1971 */ 1972 if ( ! has_filter( 'query', array( $this, 'remove_placeholder_escape' ) ) ) { 1973 add_filter( 'query', array( $this, 'remove_placeholder_escape' ), 0 ); 1974 } 1975 1976 return $placeholder; 1977 } 1978 1979 /** 1980 * Adds a placeholder escape string, to escape anything that resembles a printf() placeholder. 1981 * 1982 * @since 4.8.3 1983 * 1984 * @param string $query The query to escape. 1985 * @return string The query with the placeholder escape string inserted where necessary. 1986 */ 1987 public function add_placeholder_escape( $query ) { 1988 /* 1989 * To prevent returning anything that even vaguely resembles a placeholder, 1990 * we clobber every % we can find. 1991 */ 1992 return str_replace( '%', $this->placeholder_escape(), $query ); 1993 } 1994 1995 /** 1996 * Removes the placeholder escape strings from a query. 1997 * 1998 * @since 4.8.3 1999 * 2000 * @param string $query The query from which the placeholder will be removed. 2001 * @return string The query with the placeholder removed. 2002 */ 2003 public function remove_placeholder_escape( $query ) { 2004 return str_replace( $this->placeholder_escape(), '%', $query ); 1892 2005 } 1893 2006
Note: See TracChangeset
for help on using the changeset viewer.