Skip to content

Commit 418cf1c

Browse files
committed
DB/PreparedSQL: fix false positives with case-insensitive function names
The sniff was incorrectly flagging valid SQL escaping functions when they were written with mixed or uppercase letters (e.g., 'Esc_Sql' instead of 'esc_sql'). This occurred because the function name comparison was case-sensitive when checking against the predefined list of safe SQL escaping functions. This fix ensures that function names are properly normalized to lowercase before comparing them against the allowed escaping functions list, preventing false positives regardless of the function name's capitalization.
1 parent afcb17e commit 418cf1c

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

WordPress/Sniffs/DB/PreparedSQLSniff.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -207,10 +207,11 @@ static function ( $symbol ) {
207207
}
208208

209209
if ( \T_STRING === $this->tokens[ $this->i ]['code'] ) {
210+
$content_lowercase = strtolower( $this->tokens[ $this->i ]['content'] );
210211

211212
if (
212-
isset( $this->SQLEscapingFunctions[ $this->tokens[ $this->i ]['content'] ] )
213-
|| isset( $this->SQLAutoEscapedFunctions[ $this->tokens[ $this->i ]['content'] ] )
213+
isset( $this->SQLEscapingFunctions[ $content_lowercase ] )
214+
|| isset( $this->SQLAutoEscapedFunctions[ $content_lowercase ] )
214215
) {
215216

216217
// Find the opening parenthesis.

WordPress/Tests/DB/PreparedSQLUnitTest.1.inc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ $all_post_meta = $wpdb->get_results( $wpdb->prepare( sprintf(
3030
), $post_ids ) );
3131

3232
$wpdb->query( "SELECT * FROM $wpdb->posts WHERE post_title LIKE '" . esc_sql( $foo ) . "';" ); // Ok.
33-
$wpdb->query( "SELECT * FROM $wpdb->posts WHERE ID = " . absint( $foo ) . ";" ); // Ok.
33+
$wpdb->query( "SELECT * FROM $wpdb->posts WHERE ID = " . ABSINT( $foo ) . ";" ); // Ok.
3434

3535
// Test multi-line strings.
3636
$all_post_meta = $wpdb->get_results( $wpdb->prepare( sprintf(
@@ -79,7 +79,7 @@ $all_post_meta = $wpdb->get_results( $wpdb->prepare( sprintf( <<<'ND'
7979
AND `post_id` IN (%s)
8080
ND
8181
, $wpdb->postmeta,
82-
IMPLODE( ',', array_fill( 0, count( $post_ids ), '%d' ) )
82+
IMPLODE( ',', array_fill( 0, COUNT( $post_ids ), '%d' ) )
8383
), $post_ids ) ); // OK.
8484

8585
wpdb::prepare( "SELECT * FROM $wpdb?->posts WHERE post_title LIKE '" . foo() . "';" ); // Bad.

0 commit comments

Comments
 (0)