WordPress-Coding-Standards icon indicating copy to clipboard operation
WordPress-Coding-Standards copied to clipboard

Prepared SQL sniff: support array_map()

Open Chouby opened this issue 8 years ago • 2 comments

Hi,

intval is accepted as an SQL escaping function but it is most often used together with array_map. In WPCS 0.12.0, the query at https://github.com/WordPress/WordPress/blob/4.8/wp-includes/taxonomy.php#L3330 gives the error: Use placeholders and $wpdb->prepare(); found array_map

Chouby avatar Jul 22 '17 19:07 Chouby

I thought that at one point this might have been supported, but I just checked against 0.10.0 and 0.11.0 and both also give the error. So this is apparently not a regression.

Edit: I guess I was thinking of the XSS sniff, which does support array_map().

Related: https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/843, which would introduce some helper code that the sniff could probably use to handle this kind of checks better.

JDGrimes avatar Jul 23 '17 00:07 JDGrimes

Note that the implode() part should already be handled correctly, see #515.

JDGrimes avatar Jul 23 '17 00:07 JDGrimes