Skip to content

Use wp tablename placeholder in db queries #3223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Crabcyborg wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Use wp tablename placeholder in db queries #3223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2270c43
Use wp tablename placeholder in db queries
Crabcyborg Aug 6, 2026
874c285
Remove a unit test
Crabcyborg Aug 6, 2026
87325ac
Add more unit tests
Crabcyborg Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion classes/controllers/FrmWelcomeTourController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,7 @@ private static function more_than_the_default_form_exists() {
*/
private static function check_for_form_embeds() {
global $wpdb;
$result = $wpdb->get_var( "SELECT 1 FROM {$wpdb->posts} WHERE post_content LIKE '%[formidable %' LIMIT 1" );
$result = $wpdb->get_var( $wpdb->prepare( 'SELECT 1 FROM %i WHERE post_content LIKE %s LIMIT 1', $wpdb->posts, '%[formidable %' ) );
return '1' === $result;
}

Expand Down
8 changes: 5 additions & 3 deletions classes/helpers/FrmEmailSummaryHelper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,10 +330,12 @@ public static function get_top_forms( $from_date, $to_date, $limit = 5 ) {

$result = $wpdb->get_results(
$wpdb->prepare(
"SELECT fr.id AS form_id, fr.name AS form_name, COUNT(*) as items_count
FROM {$wpdb->prefix}frm_items AS it INNER JOIN {$wpdb->prefix}frm_forms AS fr ON it.form_id = fr.id
'SELECT fr.id AS form_id, fr.name AS form_name, COUNT(*) as items_count
FROM %i AS it INNER JOIN %i AS fr ON it.form_id = fr.id
WHERE it.created_at BETWEEN %s AND %s AND it.is_draft = 0 AND parent_form_id = 0
GROUP BY form_id ORDER BY items_count DESC LIMIT %d",
GROUP BY form_id ORDER BY items_count DESC LIMIT %d',
$wpdb->prefix . 'frm_items',
$wpdb->prefix . 'frm_forms',
$from_date,
$to_date . ' 23:59:59',
intval( $limit )
Expand Down
4 changes: 2 additions & 2 deletions classes/helpers/FrmFormsListHelper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -710,8 +710,8 @@ private function query_posts_contain_form( $form ) {
$like_where = implode( ' OR ', $like_where );
$where = "post_type IN ('post', 'page') AND ($like_where)";

// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$posts = $wpdb->get_results( "SELECT ID,post_title,post_name FROM $wpdb->posts WHERE $where" );
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$posts = $wpdb->get_results( $wpdb->prepare( 'SELECT ID,post_title,post_name FROM %i', $wpdb->posts ) . ' WHERE ' . $where );

if ( ! is_array( $posts ) ) {
return array();
Expand Down
3 changes: 1 addition & 2 deletions classes/models/FrmDb.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -823,8 +823,7 @@ public static function cache_delete_group( $group ) {
public static function db_column_exists( $table, $column ) {
global $wpdb;

// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$result = $wpdb->get_results( $wpdb->prepare( 'SHOW COLUMNS FROM ' . $wpdb->prefix . $table . ' LIKE %s', $column ) );
$result = $wpdb->get_results( $wpdb->prepare( 'SHOW COLUMNS FROM %i LIKE %s', $wpdb->prefix . $table, $column ) );
return ! empty( $result );
}
}
4 changes: 2 additions & 2 deletions classes/models/FrmEntry.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,8 +383,8 @@ public static function destroy( $id ) {
*/
do_action( 'frm_before_destroy_entry', $id, $entry );

$wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_item_metas WHERE item_id=%d', $id ) );
$result = $wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_items WHERE id=%d', $id ) );
$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE item_id=%d', $wpdb->prefix . 'frm_item_metas', $id ) );
$result = $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE id=%d', $wpdb->prefix . 'frm_items', $id ) );

self::clear_cache();

Expand Down
9 changes: 5 additions & 4 deletions classes/models/FrmEntryMeta.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,9 +185,10 @@ public static function update_entry_metas( $entry_id, $values ) {
'field_id' => $field_ids_to_remove,
);
FrmDb::get_where_clause_and_values( $where );
array_unshift( $where['values'], $wpdb->prefix . 'frm_item_metas' );

// Delete any leftovers
$wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_item_metas ' . $where['where'], $where['values'] ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, SlevomatCodingStandard.Files.LineLength.LineTooLong
$wpdb->query( $wpdb->prepare( 'DELETE FROM %i ' . $where['where'], $where['values'] ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
self::clear_cache();
}

Expand Down Expand Up @@ -226,7 +227,7 @@ public static function delete_entry_meta( $entry_id, $field_id ) {
global $wpdb;
self::clear_cache();

return $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}frm_item_metas WHERE field_id=%d AND item_id=%d", $field_id, $entry_id ) );
return $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE field_id=%d AND item_id=%d', $wpdb->prefix . 'frm_item_metas', $field_id, $entry_id ) );
}

/**
Expand Down Expand Up @@ -356,7 +357,7 @@ private static function meta_field_query( $field_id, $order, $limit, $args, arra
if ( is_numeric( $field_id ) ) {
$query[] = $wpdb->prepare( 'WHERE em.field_id=%d', $field_id );
} else {
$query[] = $wpdb->prepare( 'LEFT JOIN ' . $wpdb->prefix . 'frm_fields fi ON (em.field_id = fi.id) WHERE fi.field_key=%s', $field_id );
$query[] = $wpdb->prepare( 'LEFT JOIN %i fi ON (em.field_id = fi.id) WHERE fi.field_key=%s', $wpdb->prefix . 'frm_fields', $field_id );
}

if ( ! $args['is_draft'] ) {
Expand Down Expand Up @@ -636,7 +637,7 @@ public static function search_entry_metas( $search, $field_id, $operator ) {
$search = '%' . $search . '%';
}

$query = $wpdb->prepare( "SELECT DISTINCT item_id FROM {$wpdb->prefix}frm_item_metas WHERE meta_value {$operator} %s and field_id = %d", $search, $field_id ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, SlevomatCodingStandard.Files.LineLength.LineTooLong
$query = $wpdb->prepare( "SELECT DISTINCT item_id FROM %i WHERE meta_value {$operator} %s and field_id = %d", $wpdb->prefix . 'frm_item_metas', $search, $field_id ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, SlevomatCodingStandard.Files.LineLength.LineTooLong
}//end if

$results = $wpdb->get_col( $query, 0 ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
Expand Down
8 changes: 4 additions & 4 deletions classes/models/FrmField.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -836,9 +836,9 @@ public static function destroy( $id ) {

self::delete_form_transient( $field->form_id );

$wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_item_metas WHERE field_id=%d', $id ) );
$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE field_id=%d', $wpdb->prefix . 'frm_item_metas', $id ) );

return $wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_fields WHERE id=%d', $id ) );
return $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE id=%d', $wpdb->prefix . 'frm_fields', $id ) );
}

/**
Expand All @@ -854,7 +854,7 @@ public static function delete_form_transient( $form_id ) {
delete_transient( 'frm_form_fields_' . $form_id . 'excludeexclude' );

global $wpdb;
$wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->options . ' WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s', '_transient_timeout_frm_form_fields_' . $form_id . 'ex%', '_transient_frm_form_fields_' . $form_id . 'ex%', '_transient_timeout_frm_form_fields_' . $form_id . 'in%', '_transient_frm_form_fields_' . $form_id . 'in%' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s', $wpdb->options, '_transient_timeout_frm_form_fields_' . $form_id . 'ex%', '_transient_frm_form_fields_' . $form_id . 'ex%', '_transient_timeout_frm_form_fields_' . $form_id . 'in%', '_transient_frm_form_fields_' . $form_id . 'in%' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong

FrmDb::cache_delete_group( 'frm_field' );

Expand Down Expand Up @@ -892,7 +892,7 @@ public static function getOne( $id, $filter = false ) {
global $wpdb;

$where = is_numeric( $id ) ? 'id=%d' : 'field_key=%s';
$query = $wpdb->prepare( 'SELECT * FROM ' . $wpdb->prefix . 'frm_fields WHERE ' . $where, $id ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$query = $wpdb->prepare( 'SELECT * FROM %i WHERE ' . $where, $wpdb->prefix . 'frm_fields', $id ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared

$results = FrmDb::check_cache( $id, 'frm_field', $query, 'get_row', 0 );

Expand Down
9 changes: 5 additions & 4 deletions classes/models/FrmForm.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -636,9 +636,10 @@ public static function set_status( $id, $status ) {
'or' => 1,
);
FrmDb::get_where_clause_and_values( $where );
array_unshift( $where['values'], $status );
array_unshift( $where['values'], $wpdb->prefix . 'frm_forms', $status );

$query_results = $wpdb->query( $wpdb->prepare( 'UPDATE ' . $wpdb->prefix . 'frm_forms SET status = %s ' . $where['where'], $where['values'] ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, SlevomatCodingStandard.Files.LineLength.LineTooLong
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$query_results = $wpdb->query( $wpdb->prepare( 'UPDATE %i SET status = %s ' . $where['where'], $where['values'] ) );
} else {
$query_results = $wpdb->update( $wpdb->prefix . 'frm_forms', array( 'status' => $status ), array( 'id' => $id ) );
$wpdb->update( $wpdb->prefix . 'frm_forms', array( 'status' => $status ), array( 'parent_form_id' => $id ) );
Expand Down Expand Up @@ -729,9 +730,9 @@ public static function destroy( $id ) {
}

// Disconnect the fields from this form
$wpdb->query( $wpdb->prepare( 'DELETE fi FROM ' . $wpdb->prefix . 'frm_fields AS fi LEFT JOIN ' . $wpdb->prefix . 'frm_forms fr ON (fi.form_id = fr.id) WHERE fi.form_id=%d OR parent_form_id=%d', $id, $id ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$wpdb->query( $wpdb->prepare( 'DELETE fi FROM %i AS fi LEFT JOIN %i fr ON (fi.form_id = fr.id) WHERE fi.form_id=%d OR parent_form_id=%d', $wpdb->prefix . 'frm_fields', $wpdb->prefix . 'frm_forms', $id, $id ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong

$query_results = $wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->prefix . 'frm_forms WHERE id=%d OR parent_form_id=%d', $id, $id ) );
$query_results = $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE id=%d OR parent_form_id=%d', $wpdb->prefix . 'frm_forms', $id, $id ) );

if ( ! $query_results ) {
return $query_results;
Expand Down
26 changes: 13 additions & 13 deletions classes/models/FrmMigrate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,28 +302,28 @@ private function add_composite_indexes_for_entries() {
$index_name = 'idx_is_draft_created_at';

if ( ! self::index_exists( $table_name, $index_name ) ) {
$wpdb->query( "CREATE INDEX idx_is_draft_created_at ON `{$wpdb->prefix}frm_items` (is_draft, created_at)" );
$wpdb->query( $wpdb->prepare( 'CREATE INDEX idx_is_draft_created_at ON %i (is_draft, created_at)', $table_name ) );
}

$table_name = "{$wpdb->prefix}frm_item_metas";
$index_name = 'idx_field_id_item_id';

if ( ! self::index_exists( $table_name, $index_name ) ) {
$wpdb->query( "CREATE INDEX idx_field_id_item_id ON `{$wpdb->prefix}frm_item_metas` (field_id, item_id)" );
$wpdb->query( $wpdb->prepare( 'CREATE INDEX idx_field_id_item_id ON %i (field_id, item_id)', $table_name ) );
}

$table_name = "{$wpdb->prefix}frm_items";
$index_name = 'idx_form_id_is_draft';

if ( ! self::index_exists( $table_name, $index_name ) ) {
$wpdb->query( "CREATE INDEX idx_form_id_is_draft ON `{$wpdb->prefix}frm_items` (form_id, is_draft)" );
$wpdb->query( $wpdb->prepare( 'CREATE INDEX idx_form_id_is_draft ON %i (form_id, is_draft)', $table_name ) );
}

$table_name = "{$wpdb->prefix}frm_fields";
$index_name = 'idx_form_id_type';

if ( ! self::index_exists( $table_name, $index_name ) ) {
$wpdb->query( "CREATE INDEX idx_form_id_type ON `{$wpdb->prefix}frm_fields` (form_id, type(30))" );
$wpdb->query( $wpdb->prepare( 'CREATE INDEX idx_form_id_type ON %i (form_id, type(30))', $table_name ) );
}
}

Expand Down Expand Up @@ -428,11 +428,11 @@ public function uninstall() {

global $wpdb, $wp_roles;

$wpdb->query( 'DROP TABLE IF EXISTS ' . $this->fields ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( 'DROP TABLE IF EXISTS ' . $this->forms ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( 'DROP TABLE IF EXISTS ' . $this->entries ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( 'DROP TABLE IF EXISTS ' . $this->entry_metas ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( 'DROP TABLE IF EXISTS ' . $this->gated_tokens ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $this->fields ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $this->forms ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $this->entries ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $this->entry_metas ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $this->gated_tokens ) );

delete_option( 'frm_options' );
delete_option( 'frm_db_version' );
Expand Down Expand Up @@ -463,7 +463,7 @@ public function uninstall() {
remove_action( 'before_delete_post', 'FrmProDisplaysController::before_delete_post' );
remove_action( 'deleted_post', 'FrmProEntriesController::delete_entry' );

$post_ids = $wpdb->get_col( $wpdb->prepare( 'SELECT ID FROM ' . $wpdb->posts . ' WHERE post_type in (%s, %s, %s)', FrmFormActionsController::$action_post_type, FrmStylesController::$post_type, 'frm_display' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$post_ids = $wpdb->get_col( $wpdb->prepare( 'SELECT ID FROM %i WHERE post_type in (%s, %s, %s)', $wpdb->posts, FrmFormActionsController::$action_post_type, FrmStylesController::$post_type, 'frm_display' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong

foreach ( $post_ids as $post_id ) {
// Delete's each post.
Expand All @@ -477,7 +477,7 @@ public function uninstall() {
delete_transient( 'frmpro_options' );
delete_transient( FrmOnboardingWizardController::TRANSIENT_NAME );

$wpdb->query( $wpdb->prepare( 'DELETE FROM ' . $wpdb->options . ' WHERE option_name LIKE %s OR option_name LIKE %s', '_transient_timeout_frm_form_fields_%', '_transient_frm_form_fields_%' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE option_name LIKE %s OR option_name LIKE %s', $wpdb->options, '_transient_timeout_frm_form_fields_%', '_transient_frm_form_fields_%' ) ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong

do_action( 'frm_after_uninstall' );

Expand Down Expand Up @@ -759,10 +759,10 @@ private function migrate_to_25() {
*/
private function migrate_to_23() {
global $wpdb;
$exists = $wpdb->get_row( 'SHOW COLUMNS FROM ' . $this->forms . ' LIKE "parent_form_id"' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$exists = $wpdb->get_row( $wpdb->prepare( 'SHOW COLUMNS FROM %i LIKE %s', $this->forms, 'parent_form_id' ) );

if ( ! $exists ) {
$wpdb->query( 'ALTER TABLE ' . $this->forms . ' ADD parent_form_id int(11) default 0' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$wpdb->query( $wpdb->prepare( 'ALTER TABLE %i ADD parent_form_id int(11) default 0', $this->forms ) );
}
}

Expand Down
2 changes: 1 addition & 1 deletion classes/models/FrmStyle.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,7 +588,7 @@ public function get_all( $orderby = 'title', $order = 'ASC', $limit = 99 ) {
if ( ! $temp_styles ) {
global $wpdb;
// Make sure there wasn't a conflict with the query
$query = $wpdb->prepare( 'SELECT * FROM ' . $wpdb->posts . ' WHERE post_type=%s AND post_status=%s ORDER BY post_title ASC LIMIT 99', FrmStylesController::$post_type, 'publish' ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$query = $wpdb->prepare( 'SELECT * FROM %i WHERE post_type=%s AND post_status=%s ORDER BY post_title ASC LIMIT 99', $wpdb->posts, FrmStylesController::$post_type, 'publish' ); // phpcs:ignore SlevomatCodingStandard.Files.LineLength.LineTooLong
$temp_styles = FrmDb::check_cache( 'frm_backup_style_check', 'frm_styles', $query, 'get_results' );

if ( ! $temp_styles ) {
Expand Down
Loading