![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changeset 42061 for branches/4.4/tests/phpunit/tests/db.php
- Timestamp:
- 10/31/2017 12:45:48 PM (9 years ago)
- Location:
- branches/4.4
- Files:
-
- 2 edited
-
. (modified) (1 prop)
-
tests/phpunit/tests/db.php (modified) (4 diffs)
Legend:
- Unmodified
- Added
- Removed
-
branches/4.4
- Property svn:mergeinfo changed
/trunk merged: 41662,42056
- Property svn:mergeinfo changed
-
branches/4.4/tests/phpunit/tests/db.php
r41501 r42061 270 270 global $wpdb; 271 271 $sql = $wpdb->prepare( "UPDATE test_table SET string_column = '%%f is a float, %%d is an int %d, %%s is a string', field = %s", 3, '4' ); 272 $this->assertContains( $wpdb->placeholder_escape(), $sql ); 273 274 $sql = $wpdb->remove_placeholder_escape( $sql ); 272 275 $this->assertEquals( "UPDATE test_table SET string_column = '%f is a float, %d is an int 3, %s is a string', field = '4'", $sql ); 273 276 } … … 375 378 } 376 379 377 378 380 function test_prepare_vsprintf() { 381 global $wpdb; 379 382 380 383 $prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, "admin" ) ); … … 393 396 $prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( array( 1 ), "admin" ) ); 394 397 $this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared ); 395 } 398 } 399 400 /** 401 * @ticket 42040 402 * @dataProvider data_prepare_incorrect_arg_count 403 * @expectedIncorrectUsage wpdb::prepare 404 */ 405 public function test_prepare_incorrect_arg_count( $query, $args, $expected ) { 406 global $wpdb; 407 408 // $query is the first argument to be passed to wpdb::prepare() 409 array_unshift( $args, $query ); 410 411 $prepared = @call_user_func_array( array( $wpdb, 'prepare' ), $args ); 412 $this->assertEquals( $expected, $prepared ); 413 } 414 415 public function data_prepare_incorrect_arg_count() { 416 global $wpdb; 417 418 return array( 419 array( 420 "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", // Query 421 array( 1, "admin", "extra-arg" ), // ::prepare() args, to be passed via call_user_func_array 422 "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", // Expected output 423 ), 424 array( 425 "SELECT * FROM $wpdb->users WHERE id = %%%d AND user_login = %s", 426 array( 1 ), 427 false, 428 ), 429 array( 430 "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 431 array( array( 1, "admin", "extra-arg" ) ), 432 "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", 433 ), 434 array( 435 "SELECT * FROM $wpdb->users WHERE id = %d AND %% AND user_login = %s", 436 array( 1, "admin", "extra-arg" ), 437 "SELECT * FROM $wpdb->users WHERE id = 1 AND {$wpdb->placeholder_escape()} AND user_login = 'admin'", 438 ), 439 array( 440 "SELECT * FROM $wpdb->users WHERE id = %%%d AND %F AND %f AND user_login = %s", 441 array( 1, 2.3, "4.5", "admin", "extra-arg" ), 442 "SELECT * FROM $wpdb->users WHERE id = {$wpdb->placeholder_escape()}1 AND 2.300000 AND 4.500000 AND user_login = 'admin'", 443 ), 444 array( 445 "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 446 array( array( 1 ), "admin", "extra-arg" ), 447 "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", 448 ), 449 array( 450 "SELECT * FROM $wpdb->users WHERE id = %d and user_nicename = %s and user_status = %d and user_login = %s", 451 array( 1, "admin", 0 ), 452 '', 453 ), 454 array( 455 "SELECT * FROM $wpdb->users WHERE id = %d and user_nicename = %s and user_status = %d and user_login = %s", 456 array( array( 1, "admin", 0 ) ), 457 '', 458 ), 459 array( 460 "SELECT * FROM $wpdb->users WHERE id = %d and %% and user_login = %s and user_status = %d and user_login = %s", 461 array( 1, "admin", "extra-arg" ), 462 '', 463 ), 464 ); 465 } 396 466 397 467 function test_db_version() { … … 985 1055 986 1056 /** 987 * 988 */ 989 function test_prepare_with_unescaped_percents() { 990 global $wpdb; 991 992 $sql = $wpdb->prepare( '%d %1$d %%% %', 1 ); 993 $this->assertEquals( '1 %1$d %% %', $sql ); 1057 * @dataProvider data_prepare_with_placeholders 1058 */ 1059 function test_prepare_with_placeholders_and_individual_args( $sql, $values, $incorrect_usage, $expected) { 1060 global $wpdb; 1061 1062 if ( $incorrect_usage ) { 1063 $this->setExpectedIncorrectUsage( 'wpdb::prepare' ); 1064 } 1065 1066 if ( ! is_array( $values ) ) { 1067 $values = array( $values ); 1068 } 1069 1070 array_unshift( $values, $sql ); 1071 1072 $sql = call_user_func_array( array( $wpdb, 'prepare' ), $values ); 1073 $this->assertEquals( $expected, $sql ); 1074 } 1075 1076 /** 1077 * @dataProvider data_prepare_with_placeholders 1078 */ 1079 function test_prepare_with_placeholders_and_array_args( $sql, $values, $incorrect_usage, $expected) { 1080 global $wpdb; 1081 1082 if ( $incorrect_usage ) { 1083 $this->setExpectedIncorrectUsage( 'wpdb::prepare' ); 1084 } 1085 1086 if ( ! is_array( $values ) ) { 1087 $values = array( $values ); 1088 } 1089 1090 $sql = call_user_func_array( array( $wpdb, 'prepare' ), array( $sql, $values ) ); 1091 $this->assertEquals( $expected, $sql ); 1092 } 1093 1094 function data_prepare_with_placeholders() { 1095 global $wpdb; 1096 1097 return array( 1098 array( 1099 '%5s', // SQL to prepare 1100 'foo', // Value to insert in the SQL 1101 false, // Whether to expect an incorrect usage error or not 1102 ' foo', // Expected output 1103 ), 1104 array( 1105 '%1$d %%% % %%1$d%% %%%1$d%%', 1106 1, 1107 true, 1108 "1 {$wpdb->placeholder_escape()}{$wpdb->placeholder_escape()} {$wpdb->placeholder_escape()} {$wpdb->placeholder_escape()}1\$d{$wpdb->placeholder_escape()} {$wpdb->placeholder_escape()}1{$wpdb->placeholder_escape()}", 1109 ), 1110 array( 1111 '%-5s', 1112 'foo', 1113 false, 1114 'foo ', 1115 ), 1116 array( 1117 '%05s', 1118 'foo', 1119 false, 1120 '00foo', 1121 ), 1122 array( 1123 "%'#5s", 1124 'foo', 1125 false, 1126 '##foo', 1127 ), 1128 array( 1129 '%.3s', 1130 'foobar', 1131 false, 1132 'foo', 1133 ), 1134 array( 1135 '%.3f', 1136 5.123456, 1137 false, 1138 '5.123', 1139 ), 1140 array( 1141 '%.3f', 1142 5.12, 1143 false, 1144 '5.120', 1145 ), 1146 array( 1147 '%s', 1148 ' %s ', 1149 false, 1150 "' {$wpdb->placeholder_escape()}s '", 1151 ), 1152 array( 1153 '%1$s', 1154 ' %s ', 1155 false, 1156 " {$wpdb->placeholder_escape()}s ", 1157 ), 1158 array( 1159 '%1$s', 1160 ' %1$s ', 1161 false, 1162 " {$wpdb->placeholder_escape()}1\$s ", 1163 ), 1164 array( 1165 '%d %1$d %%% %', 1166 1, 1167 true, 1168 "1 1 {$wpdb->placeholder_escape()}{$wpdb->placeholder_escape()} {$wpdb->placeholder_escape()}", 1169 ), 1170 array( 1171 '%d %2$s', 1172 array( 1, 'hello' ), 1173 false, 1174 "1 hello", 1175 ), 1176 array( 1177 "'%s'", 1178 'hello', 1179 false, 1180 "'hello'", 1181 ), 1182 array( 1183 '"%s"', 1184 'hello', 1185 false, 1186 "'hello'", 1187 ), 1188 array( 1189 "%s '%1\$s'", 1190 'hello', 1191 true, 1192 "'hello' 'hello'", 1193 ), 1194 array( 1195 "%s '%1\$s'", 1196 'hello', 1197 true, 1198 "'hello' 'hello'", 1199 ), 1200 array( 1201 '%s "%1$s"', 1202 'hello', 1203 true, 1204 "'hello' \"hello\"", 1205 ), 1206 array( 1207 "%%s %%'%1\$s'", 1208 'hello', 1209 false, 1210 "{$wpdb->placeholder_escape()}s {$wpdb->placeholder_escape()}'hello'", 1211 ), 1212 array( 1213 '%%s %%"%1$s"', 1214 'hello', 1215 false, 1216 "{$wpdb->placeholder_escape()}s {$wpdb->placeholder_escape()}\"hello\"", 1217 ), 1218 array( 1219 '%s', 1220 ' % s ', 1221 false, 1222 "' {$wpdb->placeholder_escape()} s '", 1223 ), 1224 array( 1225 '%%f %%"%1$f"', 1226 3, 1227 false, 1228 "{$wpdb->placeholder_escape()}f {$wpdb->placeholder_escape()}\"3.000000\"", 1229 ), 1230 array( 1231 'WHERE second=\'%2$s\' AND first=\'%1$s\'', 1232 array( 'first arg', 'second arg' ), 1233 false, 1234 "WHERE second='second arg' AND first='first arg'", 1235 ), 1236 array( 1237 'WHERE second=%2$d AND first=%1$d', 1238 array( 1, 2 ), 1239 false, 1240 "WHERE second=2 AND first=1", 1241 ), 1242 array( 1243 "'%'%%s", 1244 'hello', 1245 true, 1246 "'{$wpdb->placeholder_escape()}'{$wpdb->placeholder_escape()}s", 1247 ), 1248 array( 1249 "'%'%%s%s", 1250 'hello', 1251 false, 1252 "'{$wpdb->placeholder_escape()}'{$wpdb->placeholder_escape()}s'hello'", 1253 ), 1254 array( 1255 "'%'%%s %s", 1256 'hello', 1257 false, 1258 "'{$wpdb->placeholder_escape()}'{$wpdb->placeholder_escape()}s 'hello'", 1259 ), 1260 array( 1261 "'%-'#5s' '%'#-+-5s'", 1262 array( 'hello', 'foo' ), 1263 false, 1264 "'hello' 'foo##'", 1265 ), 1266 ); 1267 } 1268 1269 /** 1270 * @dataProvider data_escape_and_prepare 1271 */ 1272 function test_escape_and_prepare( $escape, $sql, $values, $incorrect_usage, $expected ) { 1273 global $wpdb; 1274 1275 if ( $incorrect_usage ) { 1276 $this->setExpectedIncorrectUsage( 'wpdb::prepare' ); 1277 } 1278 1279 $escape = esc_sql( $escape ); 1280 1281 $sql = str_replace( '{ESCAPE}', $escape, $sql ); 1282 1283 $actual = $wpdb->prepare( $sql, $values ); 1284 1285 $this->assertEquals( $expected, $actual ); 1286 } 1287 1288 function data_escape_and_prepare() { 1289 global $wpdb; 1290 return array( 1291 array( 1292 '%s', // String to pass through esc_url() 1293 ' {ESCAPE} ', // Query to insert the output of esc_url() into, replacing "{ESCAPE}" 1294 'foo', // Data to send to prepare() 1295 true, // Whether to expect an incorrect usage error or not 1296 " {$wpdb->placeholder_escape()}s ", // Expected output 1297 ), 1298 array( 1299 'foo%sbar', 1300 "SELECT * FROM bar WHERE foo='{ESCAPE}' OR baz=%s", 1301 array( ' SQLi -- -', 'pewpewpew' ), 1302 true, 1303 null, 1304 ), 1305 array( 1306 '%s', 1307 ' %s {ESCAPE} ', 1308 'foo', 1309 false, 1310 " 'foo' {$wpdb->placeholder_escape()}s ", 1311 ), 1312 ); 1313 } 1314 1315 /** 1316 * @expectedIncorrectUsage wpdb::prepare 1317 */ 1318 function test_double_prepare() { 1319 global $wpdb; 1320 1321 $part = $wpdb->prepare( ' AND meta_value = %s', ' %s ' ); 1322 $this->assertNotContains( '%s', $part ); 1323 $query = $wpdb->prepare( 'SELECT * FROM {$wpdb->postmeta} WHERE meta_key = %s $part', array( 'foo', 'bar' ) ); 1324 $this->assertNull( $query ); 1325 } 1326 1327 function test_prepare_numeric_placeholders_float_args() { 1328 global $wpdb; 1329 1330 $actual = $wpdb->prepare( 1331 'WHERE second=%2$f AND first=%1$f', 1332 1.1, 1333 2.2 1334 ); 1335 1336 /* Floats can be right padded, need to assert differently */ 1337 $this->assertContains( ' first=1.1', $actual ); 1338 $this->assertContains( ' second=2.2', $actual ); 1339 } 1340 1341 function test_prepare_numeric_placeholders_float_array() { 1342 global $wpdb; 1343 1344 $actual = $wpdb->prepare( 1345 'WHERE second=%2$f AND first=%1$f', 1346 array( 1.1, 2.2 ) 1347 ); 1348 1349 /* Floats can be right padded, need to assert differently */ 1350 $this->assertContains( ' first=1.1', $actual ); 1351 $this->assertContains( ' second=2.2', $actual ); 1352 } 1353 1354 function test_query_unescapes_placeholders() { 1355 global $wpdb; 1356 1357 $value = ' %s '; 1358 1359 $wpdb->query( "CREATE TABLE {$wpdb->prefix}test_placeholder( a VARCHAR(100) );" ); 1360 $sql = $wpdb->prepare( "INSERT INTO {$wpdb->prefix}test_placeholder VALUES(%s)", $value ); 1361 $wpdb->query( $sql ); 1362 1363 $actual = $wpdb->get_var( "SELECT a FROM {$wpdb->prefix}test_placeholder" ); 1364 1365 $wpdb->query( "DROP TABLE {$wpdb->prefix}test_placeholder" ); 1366 1367 $this->assertNotContains( '%s', $sql ); 1368 $this->assertEquals( $value, $actual ); 1369 } 1370 1371 function test_esc_sql_with_unsupported_placeholder_type() { 1372 global $wpdb; 1373 1374 $sql = $wpdb->prepare( ' %s %1$c ', 'foo' ); 1375 $sql = $wpdb->prepare( " $sql %s ", 'foo' ); 1376 1377 $this->assertEquals( " 'foo' {$wpdb->placeholder_escape()}1\$c 'foo' ", $sql ); 994 1378 } 995 1379 }
Note:
See TracChangeset
for help on using the changeset viewer.
