WordPress does not currently provide an explicit method for escaping SQL table and column names. This leads to potential security vulnerabilities, and makes reviewing code for security unnecessarily difficult. Also, static analysis tools also flag the queries as having unescaped SQL input.
Tables and column names in queries are usually in-the-raw, since using the existing `%s` will straight quote the value, making the query invalid.
This change introduces a new `%i` placeholder in `$wpdb->prepare` to properly quote table and column names using backticks.
Props tellyworth, iandunn, craigfrancis, peterwilsoncc, johnbillion, apokalyptik.
Fixes#52506.
Built from https://develop.svn.wordpress.org/trunk@53575
git-svn-id: http://core.svn.wordpress.org/trunk@53164 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When using multilingual websites, this string could end up with multiple different translations in the error log, making it less actionable.
Unlike errors displayed to the user, a general consensus for software is that errors in logs should always be in English. Since MySQL errors are also returned in English, this brings more consistency to the logs.
Follow-up to [6391], [8168], [19760].
Props malthert.
Fixes#53125.
Built from https://develop.svn.wordpress.org/trunk@53505
git-svn-id: http://core.svn.wordpress.org/trunk@53094 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changes updates many strings to remove self-references to an undefined "we" collective across the WordPress Administration.
The goal of this change is to better match the guidelines and recommendations set forth in the make/core handbook, specifically:
> the word "we" should be avoided (…) unless its made very clear which group is speaking.
Props johnbillion, shital-patel, audrasjb, marybaum, SergeyBiryukov, peterwilsoncc, johnjamesjacoby, kebbet, costdev, chaion07, davidbaumwald.
Fixes#46057.
Built from https://develop.svn.wordpress.org/trunk@53131
git-svn-id: http://core.svn.wordpress.org/trunk@52720 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset replaces contracted verb forms like `doesn't`, `can't`, or `isn't` with non-contracted forms like `does not`, `cannot`, or `is not`, for better consistency across the WordPress administration. It also updates some corresponding unit tests strings.
Props Presskopp, socalchristina, aandrewdixon, francina, SergeyBiryukov, JeffPaul, audrasjb, hellofromTonya.
Fixes#38913.
See #39176.
Built from https://develop.svn.wordpress.org/trunk@52978
git-svn-id: http://core.svn.wordpress.org/trunk@52567 1a063a9b-81f0-0310-95a4-ce76da25c4cd
To prevent potential false negatives, set `$error` to `null` initially, so we can better tell if it was ever changed during the sanitization and be able to better react if an empty string is added to it.
Additionally, and mainly for the sake of the Settings API at this point, add error messages to some `WP_Error` objects returned from `wpdb` methods that were previously causing the issues here.
Follow-up to [32791].
Props iCaleb, audrasjb, hellofromTonya, SergeyBiryukov.
Fixes#53986.
Built from https://develop.svn.wordpress.org/trunk@52294
git-svn-id: http://core.svn.wordpress.org/trunk@51886 1a063a9b-81f0-0310-95a4-ce76da25c4cd
For consistency and simplification, replaces the `function_exists( '__' )` checks with `wp_load_translations_early()` to make sure i18n functions are available. This change removes the extra code introduced in [52176] for using non-translated error messages when `__()` is not available.
Improves the plural versions of the error messages.
For performance, when there are more than one problem field, uses `reset()` to populate the field in the error message.
Follow-up to [52176], [52195].
Props sergeybiryukov, hellofromTonya.
Fixes#32315.
Built from https://develop.svn.wordpress.org/trunk@52218
git-svn-id: http://core.svn.wordpress.org/trunk@51810 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Instead of silently failing when attempting to insert a value into a field, this commit saves the error in the `wpdb::$last_error` property.
Sets `last_error` with an error message if:
* `wpdb::query()` fails for invalid data
* `wpdb::process_fields()` fails to process the value(s) for the field(s) where the value could be too long or contain invalid data
Sets `last_query` if `wpdb::query()` fails for invalid data.
If `__()` is not available, uses non-translated error message to ensure the error is captured.
There is no change to wpdb aborting when an error occurs.
Adds tests.
Props dlt101, mnelson4, dd32, pento, hellofromTonya, davidbaumwald, sergeybiryukov, johnbillion, swissspidy, datainterlock, anandau14, anthonyeden, asif2bd, audrasjb, chaion07, dpegasusm, fpcsjames, galbaras, jdgrimes, justindocanto, kwisatz, liammitchell, lucasw89, lukecarbis, nettsite, nlpro, procodewp, psufan, richardfoley, skunkbad, travisnorthcutt, woodyhayday, zoiec.
Fixes#37267.
Built from https://develop.svn.wordpress.org/trunk@52176
git-svn-id: http://core.svn.wordpress.org/trunk@51768 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit adds the `public` visibility keyword to each method which did not have an explicit visibility keyword.
Why `public`?
With no visibility previously declared, these methods are implicitly `public` and available for use. Changing them to anything else would be a backwards-compatibility break.
Props costdev, jrf.
See #54177.
Built from https://develop.svn.wordpress.org/trunk@51919
git-svn-id: http://core.svn.wordpress.org/trunk@51512 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter.
Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter #2 ($string) of type string is deprecated` notice on PHP 8.1.
Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980].
A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway.
This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those.
Refs:
- https://www.php.net/manual/en/mysqli.real-escape-string.php
- https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg
Follow-up to [48980].
Props jrf, hellofromTonya.
See #53635.
Built from https://develop.svn.wordpress.org/trunk@51799
git-svn-id: http://core.svn.wordpress.org/trunk@51406 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Prior to PHP 8.1, the default error handling mode was `MYSQLI_REPORT_OFF`. An error in the extension, database, query, or the database connection returned `false` and emitted a PHP warning:
{{{
$mysqli = new mysqli("localhost", "non-existing-user", "", "");
Warning: mysqli::__construct(): (HY000/2002): No connection could be made because the target machine actively refused it in ... on line ...
}}}
From PHP 8.1 and later, the default error mode is set to `MYSQLI_REPORT_ERROR|MYSQLI_REPORT_STRICT`. An error in the extension, database, query, or the database connection throws an exception:
{{{
$mysqli = new mysqli("localhost", "non-existing-user", "", "");
Fatal error: Uncaught mysqli_sql_exception: Connection refused in ...:...
}}}
WordPress has its own error reporting and gracefully handles the database errors by inspecting the error codes. Setting the MySQLi error reporting to off avoids fatal errors due to uncaught exceptions and maintains the current behavior.
References:
* [https://php.watch/versions/8.1/mysqli-error-mode PHP 8.1: MySQLi: Default error mode set to exceptions]
* [https://wiki.php.net/rfc/mysqli_default_errmode PHP RFC: Change Default mysqli Error Mode]
Props ayeshrajans, jrf.
Fixes#52825.
Built from https://develop.svn.wordpress.org/trunk@51582
git-svn-id: http://core.svn.wordpress.org/trunk@51193 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This avoids a deprecation notice on PHP 8.1 caused by passing `null` instead of a string to `ltrim()` in `wpdb::check_safe_collation()`, and maintains the current behaviour.
Follow-up to [30345], [32162], [33455].
See #53635.
Built from https://develop.svn.wordpress.org/trunk@51396
git-svn-id: http://core.svn.wordpress.org/trunk@51007 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Partially reverts [48059] as there's no full consensus on the removal of the text prefix. Further actions should be taken to improve consistency and accessibility of the admin notices. Keeps some improvements to the translatable strings from [48059].
Fixes#47656.
Built from https://develop.svn.wordpress.org/trunk@48115
git-svn-id: http://core.svn.wordpress.org/trunk@47884 1a063a9b-81f0-0310-95a4-ce76da25c4cd
For a number of years, most of the WordPress error messages have been prefixed with "Error:". However, these messages appear in a context where it's already clear an error occurred. Whether it's an error, a warning, or any other classification, that's not so relevant for users. The content of the message is the relevant part. The "Error:" prefix doesn't add great value while it does add unnecessary complexity for the message readability.
Also, revises some of these messages to improve clarity and removes HTML from translatable strings.
Props garrett-eclipse, ramiy, SergeyBiryukov, afercia, sabernhardt, quadthemes, audrasjb.
See #47003, #43037, #42945, #15887.
Fixes#47656.
Built from https://develop.svn.wordpress.org/trunk@48059
git-svn-id: http://core.svn.wordpress.org/trunk@47826 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This avoids the performance overhead of the function call every time `dirname( __FILE__ )` was used instead of `__DIR__`.
This commit also includes:
* Removing unnecessary parentheses from `include`/`require` statements. These are language constructs, not function calls.
* Replacing `include` statements for several files with `require_once`, for consistency:
* `wp-admin/admin-header.php`
* `wp-admin/admin-footer.php`
* `wp-includes/version.php`
Props ayeshrajans, desrosj, valentinbora, jrf, joostdevalk, netweb.
Fixes#48082.
Built from https://develop.svn.wordpress.org/trunk@47198
git-svn-id: http://core.svn.wordpress.org/trunk@46998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Starting with MySQL 5.7.5, the `ANSI` mode implies `ONLY_FULL_GROUP_BY`, which is already listed in `wpdb` as incompatible per [27072].
When `ANSI` is enabled on MySQL 5.7.5+, `ONLY_FULL_GROUP_BY` remains enabled even after being "unset" by `wpdb::set_sql_mode()`.
To prevent this, the `ANSI` mode should also be listed as incompatible. It is not enabled on default MySQL installations.
Props jnylen0.
Fixes#48377.
Built from https://develop.svn.wordpress.org/trunk@47171
git-svn-id: http://core.svn.wordpress.org/trunk@46971 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Originally added in [4686], these constructor/destructor pairings were designed to prevent the objects from being destroyed before shutdown, when output buffers are flushed.
A deeper investigation reveals that this approach didn't quite work as expected and was later made redundant by introducing `wp_ob_end_flush_all()` in [5462].
Props wonderboymusic, nacin, Mte90, SergeyBiryukov.
Fixes#21402.
Built from https://develop.svn.wordpress.org/trunk@47107
git-svn-id: http://core.svn.wordpress.org/trunk@46907 1a063a9b-81f0-0310-95a4-ce76da25c4cd
davidbaumwald
Sergey Biryukov
audrasjb
John Blackbourn
hellofromTonya
Andrea Fercia