Column names in wpdb->insert aren't sanitized.

[kazet]

Column names in wpdb->insert aren't sanitized, although the documentation says: "Data to insert (in column => value pairs). Both $data columns and $data values should be “raw” (neither should be SQL escaped)."

Steps To Reproduce:

<?php
global $wpdb;
$wpdb->insert("wp_posts", array("id`) VALUES (sleep(1)); -- " => 0));

This will sleep one second.

The WordPress security team has reviewed this and asked to open a public ticket.

[peterwilsoncc]

60505.diff​ is a proof of concept to use the ​identifier placeholders introduced in WordPress 6.2.

wpdb::update() is also affected and would need similar code.