Missing use of placeholders and $wpdb->prepare()

[mahekkalola]

Use placeholders and $wpdb->prepare(); found interpolated variable $prefix at "SELECT $prefix"

file path: wordpress/wp-admin/setup-config.php
Line Number: 325

[mahekkalola]

this is the line 325 from version(6.2 beta) which has not used $wpdb->prepare()

[chiragrathod103]

Created a diff file

[johnbillion]

Thank you both for the ticket and the patch.

• Have you checked the code that surrounds this to find out what it's doing?
• Have you tested the patch?

I think you'll find this is an exceptional circumstance as this query is a syntax check for the database prefix entered by the user, and wrapping it in prepare() will prevent it from detecting a disallowed prefix.

[chiragrathod103]

@johnbillion Thanks for the response.

Let's assume WP was already installed and by mistake config file was removed, and some created new config files, and the user added the wrong prefix in the config file then it will get this one screen when we use the "query" function ( ​https://prnt.sc/3mounErt7b0U )

But if we will use the "prepare" function then it will prevent users let them knowing that they are using incorrect prefix as shown in this screenshot( ​https://prnt.sc/CY0_e51YsVI5 )