PreparedSQLSniff
extends Sniff
in package
uses
WPDBTrait
Sniff for prepared SQL.
Makes sure that variables aren't directly interpolated into SQL statements.
Tags
Table of Contents
Properties
- $end : int
- The loop end marker.
- $i : int
- A loop pointer.
- $methods : array<string, bool>
- The lists of $wpdb methods.
- $phpcsFile : File
- The current file being sniffed.
- $tokens : array<string|int, mixed>
- The list of tokens in the current file being sniffed.
- $ignored_tokens : array<string|int, mixed>
- Tokens that we don't flag when they are found in a $wpdb method call.
- $SQLAutoEscapedFunctions : array<string, bool>
- Functions whose output is automatically escaped for use in SQL queries.
- $SQLEscapingFunctions : array<string, bool>
- Functions that escape values for use in SQL queries.
Methods
- process() : int|void
- Set sniff properties and hand off to child class for processing of the token.
- process_token() : int|void
- Processes this test, when one of its tokens is encountered.
- register() : array<string|int, mixed>
- Returns an array of tokens this test wants to listen for.
- is_wpdb_method_call() : bool
- Checks whether this is a call to one of a specific group of $wpdb method(s).
Properties
$end
The loop end marker.
protected
int
$end
It is a property so that we can access it in all of our methods.
Tags
$i
A loop pointer.
protected
int
$i
It is a property so that we can access it in all of our methods.
Tags
$methods
The lists of $wpdb methods.
protected
array<string, bool>
$methods
= array('get_var' => true, 'get_col' => true, 'get_row' => true, 'get_results' => true, 'prepare' => true, 'query' => true)
Tags
$phpcsFile
The current file being sniffed.
protected
File
$phpcsFile
Tags
$tokens
The list of tokens in the current file being sniffed.
protected
array<string|int, mixed>
$tokens
Tags
$ignored_tokens
Tokens that we don't flag when they are found in a $wpdb method call.
private
array<string|int, mixed>
$ignored_tokens
= array(\T_STRING_CONCAT => true, \T_CONSTANT_ENCAPSED_STRING => true, \T_COMMA => true, \T_LNUMBER => true, \T_DNUMBER => true, \T_NS_SEPARATOR => true)
This token array is augmented from within the register() method.
Tags
$SQLAutoEscapedFunctions
Functions whose output is automatically escaped for use in SQL queries.
private
array<string, bool>
$SQLAutoEscapedFunctions
= array('count' => true)
Tags
$SQLEscapingFunctions
Functions that escape values for use in SQL queries.
private
array<string, bool>
$SQLEscapingFunctions
= array('absint' => true, 'esc_sql' => true, 'floatval' => true, 'intval' => true, 'like_escape' => true)
Tags
Methods
process()
Set sniff properties and hand off to child class for processing of the token.
public
process(File $phpcsFile, int $stackPtr) : int|void
Parameters
- $phpcsFile : File
-
The file being scanned.
- $stackPtr : int
-
The position of the current token in the stack passed in $tokens.
Tags
Return values
int|void —Integer stack pointer to skip forward or void to continue normal file processing.
process_token()
Processes this test, when one of its tokens is encountered.
public
process_token(int $stackPtr) : int|void
Parameters
- $stackPtr : int
-
The position of the current token in the stack.
Tags
Return values
int|void —Integer stack pointer to skip forward or void to continue normal file processing.
register()
Returns an array of tokens this test wants to listen for.
public
register() : array<string|int, mixed>
Tags
Return values
array<string|int, mixed>is_wpdb_method_call()
Checks whether this is a call to one of a specific group of $wpdb method(s).
protected
final is_wpdb_method_call(File $phpcsFile, int $stackPtr, array<string|int, mixed> $target_methods) : bool
Supports both instance method calls (e.g., $wpdb->prepare()) and static
method calls (e.g., wpdb::esc_like()).
Note: Static calls on non-static wpdb methods are problematic at runtime, but this helper still matches them so sniffs can flag them in the code under scan.
If the following properties are explicitly declared in the class using this trait, they will be automatically set:
$methodPtr: Stack pointer to the method name.$i: Stack pointer to the opening parenthesis of the method call.$end: Stack pointer to the comma after the first parameter, or to the token directly after the first parameter if there is no comma.
The $methodPtr and $i properties may be set even when this method returns false
(e.g., for property access like $wpdb->show_errors).
Parameters
- $phpcsFile : File
-
The file being scanned.
- $stackPtr : int
-
The index of the $wpdb variable or wpdb (class) name token.
- $target_methods : array<string|int, mixed>
-
Array of methods. Key(s) should be method name in lowercase.
Tags
Return values
bool —Whether this is a $wpdb method call.