Merge pull request #115 from wp-cli/verify-and-whitelist-sql-escaping

Verify and whitelist SQL escaping

Author: schlessera

src/Search_Replace_Command.php

@@ -321,7 +321,10 @@ public function __invoke( $args, $assoc_args ) {
 
 			if ( $this->export_handle ) {
 				fwrite( $this->export_handle, "\nDROP TABLE IF EXISTS $table_sql;\n" );
+
+				// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
 				$row = $wpdb->get_row( "SHOW CREATE TABLE $table_sql", ARRAY_N );
+
 				fwrite( $this->export_handle, $row[1] . ";\n" );
 				list( $table_report, $total_rows ) = $this->php_export_table( $table, $old, $new );
 				if ( $this->report ) {
@@ -367,7 +370,10 @@ public function __invoke( $args, $assoc_args ) {
 				if ( ! $php_only && ! $this->regex ) {
 					$col_sql          = self::esc_sql_ident( $col );
 					$wpdb->last_error = '';
-					$serial_row       = $wpdb->get_row( "SELECT * FROM $table_sql WHERE $col_sql REGEXP '^[aiO]:[1-9]' LIMIT 1" );
+
+					// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
+					$serial_row = $wpdb->get_row( "SELECT * FROM $table_sql WHERE $col_sql REGEXP '^[aiO]:[1-9]' LIMIT 1" );
+
 					// When the regex triggers an error, we should fall back to PHP
 					if ( false !== strpos( $wpdb->last_error, 'ERROR 1139' ) ) {
 						$serial_row = true;
@@ -492,12 +498,14 @@ private function sql_handle_col( $col, $primary_keys, $table, $old, $new ) {
 			if ( $this->log_handle ) {
 				$count = $this->log_sql_diff( $col, $primary_keys, $table, $old, $new );
 			} else {
+				// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
 				$count = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT($col_sql) FROM $table_sql WHERE $col_sql LIKE BINARY %s;", '%' . self::esc_like( $old ) . '%' ) );
 			}
 		} else {
 			if ( $this->log_handle ) {
 				$this->log_sql_diff( $col, $primary_keys, $table, $old, $new );
 			}
+			// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
 			$count = $wpdb->query( $wpdb->prepare( "UPDATE $table_sql SET $col_sql = REPLACE($col_sql, %s, %s);", $old, $new ) );
 		}
 
@@ -518,7 +526,10 @@ private function php_handle_col( $col, $primary_keys, $table, $old, $new ) {
 		$col_sql          = self::esc_sql_ident( $col );
 		$where            = $this->regex ? '' : " WHERE $col_sql" . $wpdb->prepare( ' LIKE BINARY %s', '%' . self::esc_like( $old ) . '%' );
 		$primary_keys_sql = implode( ',', self::esc_sql_ident( $primary_keys ) );
-		$rows             = $wpdb->get_results( "SELECT {$primary_keys_sql} FROM {$table_sql} {$where}" );
+
+		// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
+		$rows = $wpdb->get_results( "SELECT {$primary_keys_sql} FROM {$table_sql} {$where}" );
+
 		foreach ( $rows as $keys ) {
 			$where_sql = '';
 			foreach ( (array) $keys as $k => $v ) {
@@ -527,7 +538,10 @@ private function php_handle_col( $col, $primary_keys, $table, $old, $new ) {
 				}
 				$where_sql .= self::esc_sql_ident( $k ) . ' = ' . self::esc_sql_value( $v );
 			}
+
+			// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
 			$col_value = $wpdb->get_var( "SELECT {$col_sql} FROM {$table_sql} WHERE {$where_sql}" );
+
 			if ( '' === $col_value ) {
 				continue;
 			}
@@ -609,9 +623,11 @@ private function write_sql_row_fields( $table, $rows ) {
 
 				if ( method_exists( $wpdb, 'remove_placeholder_escape' ) ) {
 					// since 4.8.3
+					// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- verified inputs above
 					$sql = $wpdb->remove_placeholder_escape( $wpdb->prepare( $sql, array_values( $values ) ) );
 				} else {
 					// 4.8.2 or less
+					// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- verified inputs above
 					$sql = $wpdb->prepare( $sql, array_values( $values ) );
 				}
 
@@ -638,7 +654,10 @@ private static function get_columns( $table ) {
 		$text_columns    = array();
 		$all_columns     = array();
 		$suppress_errors = $wpdb->suppress_errors();
-		$results         = $wpdb->get_results( "DESCRIBE $table_sql" );
+
+		// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
+		$results = $wpdb->get_results( "DESCRIBE $table_sql" );
+
 		if ( ! empty( $results ) ) {
 			foreach ( $results as $col ) {
 				if ( 'PRI' === $col->Key ) {
@@ -775,7 +794,12 @@ private function log_sql_diff( $col, $primary_keys, $table, $old, $new ) {
 			$primary_keys_sql = '';
 		}
 
-		$results = $wpdb->get_results( $wpdb->prepare( "SELECT {$primary_keys_sql}`$col` FROM `$table` WHERE `$col` LIKE BINARY %s", '%' . self::esc_like( $old ) . '%' ), ARRAY_N );
+		$table_sql = self::esc_sql_ident( $table );
+		$col_sql   = self::esc_sql_ident( $col );
+
+		// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- escaped through self::esc_sql_ident
+		$results = $wpdb->get_results( $wpdb->prepare( "SELECT {$primary_keys_sql}{$col_sql} FROM {$table_sql} WHERE {$col_sql} LIKE BINARY %s", '%' . self::esc_like( $old ) . '%' ), ARRAY_N );
+
 		if ( empty( $results ) ) {
 			return 0;
 		}