Cavemanon/piratepoet
8
Fork 0
Code Pull Requests Actions Releases 16 Activity

Remove confusing comments in WPDB driver

Browse Source 
On the low lever of the WPDB driver, we're indeed executing an unknown query,
and we can't say that they are by themeselves fully safe. It's higher levels of
abstraction in Doctrine that aim to prevent us from generating unsafe querires.

[MAILPOET-6150]
This commit is contained in:
Jan Jakes
2024-08-28 14:47:05 +02:00
committed by Ján Mikláš
parent 89b10e7504
commit b7b62f5fbc
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mailpoet/lib/Doctrine/WPDB/Connection.php
View File

@@ -109,7 +109,7 @@ class Connection implements ServerInfoAwareConnection {
private function runQuery(string $sql) {
global $wpdb;
try {
$value = $wpdb->query($sql); // phpcs:ignore WordPressDotOrg.sniffs.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- The variable is prepared but the sniff recognize only a string
$value = $wpdb->query($sql); // phpcs:ignore WordPressDotOrg.sniffs.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared
} catch (Throwable $e) {
if ($e instanceof PDOException) {
throw new QueryException($e->getMessage(), $e->errorInfo[0] ?? null, $e->errorInfo[1] ?? 0);

4
mailpoet/lib/Doctrine/WPDB/Statement.php
View File

@@ -62,7 +62,9 @@ class Statement implements StatementInterface {
$values = $visitor->getValues();
global $wpdb;
$query = count($values) > 0 ? $wpdb->prepare($sql, $values) : $sql; // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- The prepare method is used here to escape the values
$query = count($values) > 0
? $wpdb->prepare($sql, $values) // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
: $sql;
return $this->connection->query($query);
}
}