Skip to content

Commit a293c25

Browse files
krugazulkrugazul
committed
Updating the plugin DB queries
1 parent a134785 commit a293c25

6 files changed

Lines changed: 222 additions & 93 deletions

File tree

‎includes/classes/class-activation.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ public static function create_tables( $table_name ) {
6666
public static function maybe_upgrade( $table_name ) {
6767
global $wpdb;
6868

69+
$table_name = esc_sql( $table_name );
70+
6971
// Get the current version number, defaults to 1.0
7072
$version = get_option( 'kkd_db_version', '1.0' );
7173

@@ -87,7 +89,7 @@ public static function maybe_upgrade( $table_name ) {
8789
$wpdb->query(
8890
$wpdb->prepare(
8991
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
90-
"ALTER TABLE %i ADD `plan` VARCHAR(255) NOT NULL AFTER `paid`;",
92+
"ALTER TABLE `%s` ADD `plan` VARCHAR(255) NOT NULL AFTER `paid`;",
9193
$table_name
9294
)
9395
);
@@ -109,7 +111,7 @@ public static function maybe_upgrade( $table_name ) {
109111
$wpdb->query(
110112
$wpdb->prepare(
111113
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
112-
"ALTER TABLE %i ADD `txn_code_2` VARCHAR(255) DEFAULT '' NULL AFTER `txn_code`;",
114+
"ALTER TABLE `%s` ADD `txn_code_2` VARCHAR(255) DEFAULT '' NULL AFTER `txn_code`;",
113115
$table_name
114116
)
115117
);
@@ -131,7 +133,7 @@ public static function maybe_upgrade( $table_name ) {
131133
$wpdb->query(
132134
$wpdb->prepare(
133135
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
134-
"ALTER TABLE %i ADD `paid_at` timestamp AFTER `created_at`;",
136+
"ALTER TABLE `%s` ADD `paid_at` timestamp AFTER `created_at`;",
135137
$table_name
136138
)
137139
);

‎includes/classes/class-form-submit.php‎

Lines changed: 53 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ public function submit_action() {
297297

298298
global $wpdb;
299299
$code = $this->generate_code();
300-
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
300+
$table = esc_sql( $wpdb->prefix . PFF_PAYSTACK_TABLE );
301301

302302
$this->fixed_metadata = [];
303303

@@ -336,29 +336,58 @@ public function submit_action() {
336336
'metadata' => wp_json_encode( $this->fixed_metadata ),
337337
);
338338

339-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
340-
$exist = $wpdb->get_results(
341-
$wpdb->prepare(
342-
"SELECT *
343-
FROM %i
344-
WHERE post_id = %s
345-
AND email = %s
346-
AND user_id = %s
347-
AND amount = %s
348-
AND plan = %s
349-
AND ip = %s
350-
AND paid = '0'
351-
AND metadata = %s",
352-
$table,
353-
$insert['post_id'],
354-
$insert['email'],
355-
$insert['user_id'],
356-
$insert['amount'],
357-
$insert['plan'],
358-
$insert['ip'],
359-
$insert['metadata']
360-
)
361-
);
339+
340+
$current_version = get_bloginfo('version');
341+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
342+
// phpcs:disable WordPress.DB -- Start ignoring
343+
$exist = $wpdb->get_results(
344+
$wpdb->prepare(
345+
"SELECT *
346+
FROM $table
347+
WHERE post_id = %d
348+
AND email = %s
349+
AND user_id = %d
350+
AND amount = %f
351+
AND plan = %s
352+
AND ip = %s
353+
AND paid = '0'
354+
AND metadata = %s",
355+
$insert['post_id'],
356+
$insert['email'],
357+
$insert['user_id'],
358+
$insert['amount'],
359+
$insert['plan'],
360+
$insert['ip'],
361+
$insert['metadata']
362+
)
363+
);
364+
// phpcs:enable -- Stop ignoring
365+
} else {
366+
// phpcs:disable WordPress.DB -- Start ignoring
367+
$exist = $wpdb->get_results(
368+
$wpdb->prepare(
369+
"SELECT *
370+
FROM `$table`
371+
WHERE post_id = '%d'
372+
AND email = '%s'
373+
AND user_id = '%d'
374+
AND amount = '%f'
375+
AND plan = '%s'
376+
AND ip = '%s'
377+
AND paid = '0'
378+
AND metadata = '%s'",
379+
$insert['post_id'],
380+
$insert['email'],
381+
$insert['user_id'],
382+
$insert['amount'],
383+
$insert['plan'],
384+
$insert['ip'],
385+
$insert['metadata']
386+
)
387+
);
388+
// phpcs:enable -- Stop ignoring
389+
}
390+
362391

363392
if ( count( $exist ) > 0 ) {
364393
// phpcs:ignore WordPress.DB.DirectDatabaseQuery

‎includes/classes/class-helpers.php‎

Lines changed: 125 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -183,23 +183,47 @@ public function get_payments_by_id( $form_id = 0, $args = array() ) {
183183
'orderby' => 'created_at',
184184
);
185185
$args = wp_parse_args( $args, $defaults );
186-
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
186+
$table = esc_sql( $wpdb->prefix . PFF_PAYSTACK_TABLE );
187187
$order = strtoupper( $args['order'] );
188188

189-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
190-
$results = $wpdb->get_results(
191-
$wpdb->prepare(
192-
"SELECT *
193-
FROM %i
194-
WHERE post_id = %d
195-
AND paid = %s
196-
ORDER BY %i $order", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
197-
$table,
198-
$form_id,
199-
$args['paid'],
200-
$args['orderby'],
201-
)
202-
);
189+
$current_version = get_bloginfo('version');
190+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
191+
192+
// phpcs:disable WordPress.DB -- Start ignoring
193+
$results = $wpdb->get_results(
194+
$wpdb->prepare(
195+
"SELECT *
196+
FROM %i
197+
WHERE post_id = %d
198+
AND paid = %s
199+
ORDER BY %i $order",
200+
$table,
201+
$form_id,
202+
$args['paid'],
203+
$args['orderby'],
204+
)
205+
);
206+
// phpcs:enable -- Stop ignoring
207+
208+
} else {
209+
210+
// phpcs:disable WordPress.DB -- Start ignoring
211+
$results = $wpdb->get_results(
212+
$wpdb->prepare(
213+
"SELECT *
214+
FROM `%s`
215+
WHERE post_id = '%d'
216+
AND paid = '%s'
217+
ORDER BY '%s' $order",
218+
$table,
219+
$form_id,
220+
$args['paid'],
221+
$args['orderby'],
222+
)
223+
);
224+
// phpcs:enable -- Stop ignoring
225+
}
226+
203227
return $results;
204228
}
205229

@@ -214,17 +238,37 @@ public function get_payments_count( $form_id ) {
214238
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
215239
$num = wp_cache_get( 'form_payments_' . $form_id, 'pff_paystack' );
216240
if ( false === $num ) {
217-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
218-
$num = $wpdb->get_var(
219-
$wpdb->prepare(
220-
"SELECT COUNT(*)
221-
FROM %i
222-
WHERE post_id = %d
223-
AND paid = '1'",
224-
$table,
225-
$form_id
226-
)
227-
);
241+
242+
$current_version = get_bloginfo('version');
243+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
244+
245+
// phpcs:disable WordPress.DB -- Start ignoring
246+
$num = $wpdb->get_var(
247+
$wpdb->prepare(
248+
"SELECT COUNT(*)
249+
FROM %i
250+
WHERE post_id = %d
251+
AND paid = '1'",
252+
$table,
253+
$form_id
254+
)
255+
);
256+
// phpcs:enable -- Stop ignoring
257+
} else {
258+
// phpcs:disable WordPress.DB -- Start ignoring
259+
$num = $wpdb->get_var(
260+
$wpdb->prepare(
261+
"SELECT COUNT(*)
262+
FROM `%s`
263+
WHERE post_id = '%d'
264+
AND paid = '1'",
265+
$table,
266+
$form_id
267+
)
268+
);
269+
// phpcs:enable -- Stop ignoring
270+
}
271+
228272
wp_cache_set( 'form_payments_' . $form_id, $num, 'pff_paystack', 60*5 );
229273
}
230274
return $num;
@@ -572,7 +616,6 @@ public function get_the_user_ip() {
572616

573617
return $ip;
574618
}
575-
576619

577620
/**
578621
* Get the DB records by the transaction code supplied.
@@ -583,18 +626,36 @@ public function get_the_user_ip() {
583626
public function get_db_record( $code, $column = 'txn_code' ) {
584627
global $wpdb;
585628
$return = false;
586-
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
587-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
588-
$record = $wpdb->get_results(
589-
$wpdb->prepare(
590-
"SELECT *
591-
FROM %i
592-
WHERE %i = %s"
593-
,
594-
$table,
595-
$column,
596-
$code
597-
), 'OBJECT' );
629+
$table = esc_sql( $wpdb->prefix . PFF_PAYSTACK_TABLE );
630+
631+
$current_version = get_bloginfo('version');
632+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
633+
// phpcs:disable WordPress.DB -- Start ignoring
634+
$record = $wpdb->get_results(
635+
$wpdb->prepare(
636+
"SELECT *
637+
FROM %i
638+
WHERE %i = %s"
639+
,
640+
$table,
641+
$column,
642+
$code
643+
), 'OBJECT' );
644+
// phpcs:enable -- Stop ignoring
645+
} else {
646+
// phpcs:disable WordPress.DB -- Start ignoring
647+
$record = $wpdb->get_results(
648+
$wpdb->prepare(
649+
"SELECT *
650+
FROM `%s`
651+
WHERE '%s' = '%s'"
652+
,
653+
$table,
654+
$column,
655+
$code
656+
), 'OBJECT' );
657+
// phpcs:enable -- Stop ignoring
658+
}
598659

599660
if ( ! empty( $record ) && isset( $record[0] ) ) {
600661
$return = $record[0];
@@ -789,15 +850,32 @@ public function generate_new_code( $length = 10 ) {
789850
*/
790851
public function check_code( $code ) {
791852
global $wpdb;
792-
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
853+
$table = esc_sql( $wpdb->prefix . PFF_PAYSTACK_TABLE );
793854
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
794-
$o_exist = $wpdb->get_results(
795-
$wpdb->prepare(
796-
"SELECT * FROM %i WHERE txn_code = %s",
797-
$table,
798-
$code
799-
)
800-
);
855+
856+
$current_version = get_bloginfo('version');
857+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
858+
// phpcs:disable WordPress.DB -- Start ignoring
859+
$o_exist = $wpdb->get_results(
860+
$wpdb->prepare(
861+
"SELECT * FROM %i WHERE txn_code = %s",
862+
$table,
863+
$code
864+
)
865+
);
866+
// phpcs:enable -- Stop ignoring
867+
} else {
868+
// phpcs:disable WordPress.DB -- Start ignoring
869+
$o_exist = $wpdb->get_results(
870+
$wpdb->prepare(
871+
"SELECT * FROM `%s` WHERE txn_code = %s",
872+
$table,
873+
$code
874+
)
875+
);
876+
// phpcs:enable -- Stop ignoring
877+
}
878+
801879
return ( count( $o_exist ) > 0 );
802880
}
803881

‎includes/classes/class-retry-submit.php‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -193,16 +193,35 @@ public function generate_code() {
193193
protected function update_retry_code() {
194194
global $wpdb;
195195
$return = false;
196-
$table = $wpdb->prefix . PFF_PAYSTACK_TABLE;
196+
$table = esc_sql( $wpdb->prefix . PFF_PAYSTACK_TABLE );
197197
// phpcs:ignore WordPress.DB.DirectDatabaseQuery
198-
$return = $wpdb->query(
199-
$wpdb->prepare(
200-
"UPDATE %i SET txn_code_2 = %s WHERE txn_code = %s",
201-
$table,
202-
$this->new_code,
203-
$this->code
204-
)
205-
);
198+
199+
$current_version = get_bloginfo('version');
200+
if ( version_compare( '6.2', $current_version, '<=' ) ) {
201+
// phpcs:disable WordPress.DB -- Start ignoring
202+
$return = $wpdb->query(
203+
$wpdb->prepare(
204+
"UPDATE %i SET txn_code_2 = %s WHERE txn_code = %s",
205+
$table,
206+
$this->new_code,
207+
$this->code
208+
)
209+
);
210+
// phpcs:enable -- Stop ignoring
211+
} else {
212+
// phpcs:disable WordPress.DB -- Start ignoring
213+
$return = $wpdb->query(
214+
$wpdb->prepare(
215+
"UPDATE `%s` SET txn_code_2 = '%s' WHERE txn_code = '%s'",
216+
$table,
217+
$this->new_code,
218+
$this->code
219+
)
220+
);
221+
// phpcs:enable -- Stop ignoring
222+
}
223+
224+
206225
return $return;
207226
}
208227
}

0 commit comments

Comments
 (0)