pare()
* @see wpdb::$field_types
* @see wp_set_wpdb_vars()
*
* @param string $table Table name.
* @param array $data Data to insert (in column => value pairs).
* Both `$data` columns and `$data` values should be "raw" (neither should be SQL escaped).
* Sending a null value will cause the column to be set to NULL - the corresponding
* format is ignored in this case.
* @param string[]|string $format Optional. An array of formats to be mapped to each of the value in `$data`.
* If string, that format will be used for all of the values in `$data`.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in `$data` will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @return int|false The number of rows inserted, or false on error.
*/
public function insert( $table, $data, $format = null ) {
return $this->_insert_replace_helper( $table, $data, $format, 'INSERT' );
}
/**
* Replaces a row in the table or inserts it if it does not exist, based on a PRIMARY KEY or a UNIQUE index.
*
* A REPLACE works exactly like an INSERT, except that if an old row in the table has the same value as a new row
* for a PRIMARY KEY or a UNIQUE index, the old row is deleted before the new row is inserted.
*
* Examples:
*
* $wpdb->replace(
* 'table',
* array(
* 'ID' => 123,
* 'column1' => 'foo',
* 'column2' => 'bar',
* )
* );
* $wpdb->replace(
* 'table',
* array(
* 'ID' => 456,
* 'column1' => 'foo',
* 'column2' => 1337,
* ),
* array(
* '%d',
* '%s',
* '%d',
* )
* );
*
* @since 3.0.0
*
* @see wpdb::prepare()
* @see wpdb::$field_types
* @see wp_set_wpdb_vars()
*
* @param string $table Table name.
* @param array $data Data to insert (in column => value pairs).
* Both `$data` columns and `$data` values should be "raw" (neither should be SQL escaped).
* A primary key or unique index is required to perform a replace operation.
* Sending a null value will cause the column to be set to NULL - the corresponding
* format is ignored in this case.
* @param string[]|string $format Optional. An array of formats to be mapped to each of the value in `$data`.
* If string, that format will be used for all of the values in `$data`.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in `$data` will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @return int|false The number of rows affected, or false on error.
*/
public function replace( $table, $data, $format = null ) {
return $this->_insert_replace_helper( $table, $data, $format, 'REPLACE' );
}
/**
* Helper function for insert and replace.
*
* Runs an insert or replace query based on `$type` argument.
*
* @since 3.0.0
*
* @see wpdb::prepare()
* @see wpdb::$field_types
* @see wp_set_wpdb_vars()
*
* @param string $table Table name.
* @param array $data Data to insert (in column => value pairs).
* Both `$data` columns and `$data` values should be "raw" (neither should be SQL escaped).
* Sending a null value will cause the column to be set to NULL - the corresponding
* format is ignored in this case.
* @param string[]|string $format Optional. An array of formats to be mapped to each of the value in `$data`.
* If string, that format will be used for all of the values in `$data`.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in `$data` will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @param string $type Optional. Type of operation. Either 'INSERT' or 'REPLACE'.
* Default 'INSERT'.
* @return int|false The number of rows affected, or false on error.
*/
public function _insert_replace_helper( $table, $data, $format = null, $type = 'INSERT' ) {
$this->insert_id = 0;
if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ), true ) ) {
return false;
}
$data = $this->process_fields( $table, $data, $format );
if ( false === $data ) {
return false;
}
$formats = array();
$values = array();
foreach ( $data as $value ) {
if ( is_null( $value['value'] ) ) {
$formats[] = 'NULL';
continue;
}
$formats[] = $value['format'];
$values[] = $value['value'];
}
$fields = '`' . implode( '`, `', array_keys( $data ) ) . '`';
$formats = implode( ', ', $formats );
$sql = "$type INTO `$table` ($fields) VALUES ($formats)";
$this->check_current_query = false;
return $this->query( $this->prepare( $sql, $values ) );
}
/**
* Updates a row in the table.
*
* Examples:
*
* $wpdb->update(
* 'table',
* array(
* 'column1' => 'foo',
* 'column2' => 'bar',
* ),
* array(
* 'ID' => 1,
* )
* );
* $wpdb->update(
* 'table',
* array(
* 'column1' => 'foo',
* 'column2' => 1337,
* ),
* array(
* 'ID' => 1,
* ),
* array(
* '%s',
* '%d',
* ),
* array(
* '%d',
* )
* );
*
* @since 2.5.0
*
* @see wpdb::prepare()
* @see wpdb::$field_types
* @see wp_set_wpdb_vars()
*
* @param string $table Table name.
* @param array $data Data to update (in column => value pairs).
* Both $data columns and $data values should be "raw" (neither should be SQL escaped).
* Sending a null value will cause the column to be set to NULL - the corresponding
* format is ignored in this case.
* @param array $where A named array of WHERE clauses (in column => value pairs).
* Multiple clauses will be joined with ANDs.
* Both $where columns and $where values should be "raw".
* Sending a null value will create an IS NULL comparison - the corresponding
* format will be ignored in this case.
* @param string[]|string $format Optional. An array of formats to be mapped to each of the values in $data.
* If string, that format will be used for all of the values in $data.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in $data will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @param string[]|string $where_format Optional. An array of formats to be mapped to each of the values in $where.
* If string, that format will be used for all of the items in $where.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in $where will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @return int|false The number of rows updated, or false on error.
*/
public function update( $table, $data, $where, $format = null, $where_format = null ) {
if ( ! is_array( $data ) || ! is_array( $where ) ) {
return false;
}
$data = $this->process_fields( $table, $data, $format );
if ( false === $data ) {
return false;
}
$where = $this->process_fields( $table, $where, $where_format );
if ( false === $where ) {
return false;
}
$fields = array();
$conditions = array();
$values = array();
foreach ( $data as $field => $value ) {
if ( is_null( $value['value'] ) ) {
$fields[] = "`$field` = NULL";
continue;
}
$fields[] = "`$field` = " . $value['format'];
$values[] = $value['value'];
}
foreach ( $where as $field => $value ) {
if ( is_null( $value['value'] ) ) {
$conditions[] = "`$field` IS NULL";
continue;
}
$conditions[] = "`$field` = " . $value['format'];
$values[] = $value['value'];
}
$fields = implode( ', ', $fields );
$conditions = implode( ' AND ', $conditions );
$sql = "UPDATE `$table` SET $fields WHERE $conditions";
$this->check_current_query = false;
return $this->query( $this->prepare( $sql, $values ) );
}
/**
* Deletes a row in the table.
*
* Examples:
*
* $wpdb->delete(
* 'table',
* array(
* 'ID' => 1,
* )
* );
* $wpdb->delete(
* 'table',
* array(
* 'ID' => 1,
* ),
* array(
* '%d',
* )
* );
*
* @since 3.4.0
*
* @see wpdb::prepare()
* @see wpdb::$field_types
* @see wp_set_wpdb_vars()
*
* @param string $table Table name.
* @param array $where A named array of WHERE clauses (in column => value pairs).
* Multiple clauses will be joined with ANDs.
* Both $where columns and $where values should be "raw".
* Sending a null value will create an IS NULL comparison - the corresponding
* format will be ignored in this case.
* @param string[]|string $where_format Optional. An array of formats to be mapped to each of the values in $where.
* If string, that format will be used for all of the items in $where.
* A format is one of '%d', '%f', '%s' (integer, float, string).
* If omitted, all values in $data will be treated as strings unless otherwise
* specified in wpdb::$field_types. Default null.
* @return int|false The number of rows deleted, or false on error.
*/
public function delete( $table, $where, $where_format = null ) {
if ( ! is_array( $where ) ) {
return false;
}
$where = $this->process_fields( $table, $where, $where_format );
if ( false === $where ) {
return false;
}
$conditions = array();
$values = array();
foreach ( $where as $field => $value ) {
if ( is_null( $value['value'] ) ) {
$conditions[] = "`$field` IS NULL";
continue;
}
$conditions[] = "`$field` = " . $value['format'];
$values[] = $value['value'];
}
$conditions = implode( ' AND ', $conditions );
$sql = "DELETE FROM `$table` WHERE $conditions";
$this->check_current_query = false;
return $this->query( $this->prepare( $sql, $values ) );
}
/**
* Processes arrays of field/value pairs and field formats.
*
* This is a helper method for wpdb's CRUD methods, which take field/value pairs
* for inserts, updates, and where clauses. This method first pairs each value
* with a format. Then it determines the charset of that field, using that
* to determine if any invalid text would be stripped. If text is stripped,
* then field processing is rejected and the query fails.
*
* @since 4.2.0
*
* @param string $table Table name.
* @param array $data Array of values keyed by their field names.
* @param string[]|string $format Formats or format to be mapped to the values in the data.
* @return array|false An array of fields that contain paired value and formats.
* False for invalid values.
*/
protected function process_fields( $table, $data, $format ) {
$data = $this->process_field_formats( $data, $format );
if ( false === $data ) {
return false;
}
$data = $this->process_field_charsets( $data, $table );
if ( false === $data ) {
return false;
}
$data = $this->process_field_lengths( $data, $table );
if ( false === $data ) {
return false;
}
$converted_data = $this->strip_invalid_text( $data );
if ( $data !== $converted_data ) {
$problem_fields = array();
foreach ( $data as $field => $value ) {
if ( $value !== $converted_data[ $field ] ) {
$problem_fields[] = $field;
}
}
wp_load_translations_early();
if ( 1 === count( $problem_fields ) ) {
$this->last_error = sprintf(
/* translators: %s: Database field where the error occurred. */
__( 'WordPress database error: Processing the value for the following field failed: %s. The supplied value may be too long or contains invalid data.' ),
reset( $problem_fields )
);
} else {
$this->last_error = sprintf(
/* translators: %s: Database fields where the error occurred. */
__( 'WordPress database error: Processing the values for the following fields failed: %s. The supplied values may be too long or contain invalid data.' ),
implode( ', ', $problem_fields )
);
}
return false;
}
return $data;
}
/**
* Prepares arrays of value/format pairs as passed to wpdb CRUD methods.
*
* @since 4.2.0
*
* @param array $data Array of values keyed by their field names.
* @param string[]|string $format Formats or format to be mapped to the values in the data.
* @return array {
* Array of values and formats keyed by their field names.
*
* @type mixed $value The value to be formatted.
* @type string $format The format to be mapped to the value.
* }
*/
protected function process_field_formats( $data, $format ) {
$formats = (array) $format;
$original_formats = $formats;
foreach ( $data as $field => $value ) {
$value = array(
'value' => $value,
'format' => '%s',
);
if ( ! empty( $format ) ) {
$value['format'] = array_shift( $formats );
if ( ! $value['format'] ) {
$value['format'] = reset( $original_formats );
}
} elseif ( isset( $this->field_types[ $field ] ) ) {
$value['format'] = $this->field_types[ $field ];
}
$data[ $field ] = $value;
}
return $data;
}
/**
* Adds field charsets to field/value/format arrays generated by wpdb::process_field_formats().
*
* @since 4.2.0
*
* @param array $data {
* Array of values and formats keyed by their field names,
* as it comes from the wpdb::process_field_formats() method.
*
* @type array ...$0 {
* Value and format for this field.
*
* @type mixed $value The value to be formatted.
* @type string $format The format to be mapped to the value.
* }
* }
* @param string $table Table name.
* @return array|false {
* The same array of data with additional 'charset' keys, or false if
* the charset for the table cannot be found.
*
* @type array ...$0 {
* Value, format, and charset for this field.
*
* @type mixed $value The value to be formatted.
* @type string $format The format to be mapped to the value.
* @type string|false $charset The charset to be used for the value.
* }
* }
*/
protected function process_field_charsets( $data, $table ) {
foreach ( $data as $field => $value ) {
if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
/*
* We can skip this field if we know it isn't a string.
* This checks %d/%f versus ! %s because its sprintf() could take more.
*/
$value['charset'] = false;
} else {
$value['charset'] = $this->get_col_charset( $table, $field );
if ( is_wp_error( $value['charset'] ) ) {
return false;
}
}
$data[ $field ] = $value;
}
return $data;
}
/**
* For string fields, records the maximum string length that field can safely save.
*
* @since 4.2.1
*
* @param array $data {
* Array of values, formats, and charsets keyed by their field names,
* as it comes from the wpdb::process_field_charsets() method.
*
* @type array ...$0 {
* Value, format, and charset for this field.
*
* @type mixed $value The value to be formatted.
* @type string $format The format to be mapped to the value.
* @type string|false $charset The charset to be used for the value.
* }
* }
* @param string $table Table name.
* @return array|false {
* The same array of data with additional 'length' keys, or false if
* information for the table cannot be found.
*
* @type array ...$0 {
* Value, format, charset, and length for this field.
*
* @type mixed $value The value to be formatted.
* @type string $format The format to be mapped to the value.
* @type string|false $charset The charset to be used for the value.
* @type array|false $length {
* Information about the maximum length of the value.
* False if the column has no length.
*
* @type string $type One of 'byte' or 'char'.
* @type int $length The column length.
* }
* }
* }
*/
protected function process_field_lengths( $data, $table ) {
foreach ( $data as $field => $value ) {
if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
/*
* We can skip this field if we know it isn't a string.
* This checks %d/%f versus ! %s because its sprintf() could take more.
*/
$value['length'] = false;
} else {
$value['length'] = $this->get_col_length( $table, $field );
if ( is_wp_error( $value['length'] ) ) {
return false;
}
}
$data[ $field ] = $value;
}
return $data;
}
/**
* Retrieves one value from the database.
*
* Executes a SQL query and returns the value from the SQL result.
* If the SQL result contains more than one column and/or more than one row,
* the value in the column and row specified is returned. If $query is null,
* the value in the specified column and row from the previous SQL result is returned.
*
* @since 0.71
*
* @param string|null $query Optional. SQL query. Defaults to null, use the result from the previous query.
* @param int $x Optional. Column of value to return. Indexed from 0. Default 0.
* @param int $y Optional. Row of value to return. Indexed from 0. Default 0.
* @return string|null Database query result (as string), or null on failure.
*/
public function get_var( $query = null, $x = 0, $y = 0 ) {
$this->func_call = "\$db->get_var(\"$query\", $x, $y)";
if ( $query ) {
if ( $this->check_current_query && $this->check_safe_collation( $query ) ) {
$this->check_current_query = false;
}
$this->query( $query );
}
// Extract var out of cached results based on x,y vals.
if ( ! empty( $this->last_result[ $y ] ) ) {
$values = array_values( get_object_vars( $this->last_result[ $y ] ) );
}
// If there is a value return it, else return null.
return ( isset( $values[ $x ] ) && '' !== $values[ $x ] ) ? $values[ $x ] : null;
}
/**
* Retrieves one row from the database.
*
* Executes a SQL query and returns the row from the SQL result.
*
* @since 0.71
*
* @param string|null $query SQL query.
* @param string $output Optional. The required return type. One of OBJECT, ARRAY_A, or ARRAY_N, which
* correspond to an stdClass object, an associative array, or a numeric array,
* respectively. Default OBJECT.
* @param int $y Optional. Row to return. Indexed from 0. Default 0.
* @return array|object|null|void Database query result in format specified by $output or null on failure.
*/
public function get_row( $query = null, $output = OBJECT, $y = 0 ) {
$this->func_call = "\$db->get_row(\"$query\",$output,$y)";
if ( $query ) {
if ( $this->check_current_query && $this->check_safe_collation( $query ) ) {
$this->check_current_query = false;
}
$this->query( $query );
} else {
return null;
}
if ( ! isset( $this->last_result[ $y ] ) ) {
return null;
}
if ( OBJECT === $output ) {
return $this->last_result[ $y ] ? $this->last_result[ $y ] : null;
} elseif ( ARRAY_A === $output ) {
return $this->last_result[ $y ] ? get_object_vars( $this->last_result[ $y ] ) : null;
} elseif ( ARRAY_N === $output ) {
return $this->last_result[ $y ] ? array_values( get_object_vars( $this->last_result[ $y ] ) ) : null;
} elseif ( OBJECT === strtoupper( $output ) ) {
// Back compat for OBJECT being previously case-insensitive.
return $this->last_result[ $y ] ? $this->last_result[ $y ] : null;
} else {
$this->print_error( ' $db->get_row(string query, output type, int offset) -- Output type must be one of: OBJECT, ARRAY_A, ARRAY_N' );
}
}
/**
* Retrieves one column from the database.
*
* Executes a SQL query and returns the column from the SQL result.
* If the SQL result contains more than one column, the column specified is returned.
* If $query is null, the specified column from the previous SQL result is returned.
*
* @since 0.71
*
* @param string|null $query Optional. SQL query. Defaults to previous query.
* @param int $x Optional. Column to return. Indexed from 0. Default 0.
* @return array Database query result. Array indexed from 0 by SQL result row number.
*/
public function get_col( $query = null, $x = 0 ) {
if ( $query ) {
if ( $this->check_current_query && $this->check_safe_collation( $query ) ) {
$this->check_current_query = false;
}
$this->query( $query );
}
$new_array = array();
// Extract the column values.
if ( $this->last_result ) {
for ( $i = 0, $j = count( $this->last_result ); $i < $j; $i++ ) {
$new_array[ $i ] = $this->get_var( null, $x, $i );
}
}
return $new_array;
}
/**
* Retrieves an entire SQL result set from the database (i.e., many rows).
*
* Executes a SQL query and returns the entire SQL result.
*
* @since 0.71
*
* @param string $query SQL query.
* @param string $output Optional. Any of ARRAY_A | ARRAY_N | OBJECT | OBJECT_K constants.
* With one of the first three, return an array of rows indexed
* from 0 by SQL result row number. Each row is an associative array
* (column => value, ...), a numerically indexed array (0 => value, ...),
* or an object ( ->column = value ), respectively. With OBJECT_K,
* return an associative array of row objects keyed by the value
* of each row's first column's value. Duplicate keys are discarded.
* Default OBJECT.
* @return array|object|null Database query results.
*/
public function get_results( $query = null, $output = OBJECT ) {
$this->func_call = "\$db->get_results(\"$query\", $output)";
if ( $query ) {
if ( $this->check_current_query && $this->check_safe_collation( $query ) ) {
$this->check_current_query = false;
}
$this->query( $query );
} else {
return null;
}
$new_array = array();
if ( OBJECT === $output ) {
// Return an integer-keyed array of row objects.
return $this->last_result;
} elseif ( OBJECT_K === $output ) {
/*
* Return an array of row objects with keys from column 1.
* (Duplicates are discarded.)
*/
if ( $this->last_result ) {
foreach ( $this->last_result as $row ) {
$var_by_ref = get_object_vars( $row );
$key = array_shift( $var_by_ref );
if ( ! isset( $new_array[ $key ] ) ) {
$new_array[ $key ] = $row;
}
}
}
return $new_array;
} elseif ( ARRAY_A === $output || ARRAY_N === $output ) {
// Return an integer-keyed array of...
if ( $this->last_result ) {
if ( ARRAY_N === $output ) {
foreach ( (array) $this->last_result as $row ) {
// ...integer-keyed row arrays.
$new_array[] = array_values( get_object_vars( $row ) );
}
} else {
foreach ( (array) $this->last_result as $row ) {
// ...column name-keyed row arrays.
$new_array[] = get_object_vars( $row );
}
}
}
return $new_array;
} elseif ( strtoupper( $output ) === OBJECT ) {
// Back compat for OBJECT being previously case-insensitive.
return $this->last_result;
}
return null;
}
/**
* Retrieves the character set for the given table.
*
* @since 4.2.0
*
* @param string $table Table name.
* @return string|WP_Error Table character set, WP_Error object if it couldn't be found.
*/
protected function get_table_charset( $table ) {
$tablekey = strtolower( $table );
/**
* Filters the table charset value before the DB is checked.
*
* Returning a non-null value from the filter will effectively short-circuit
* checking the DB for the charset, returning that value instead.
*
* @since 4.2.0
*
* @param string|WP_Error|null $charset The character set to use, WP_Error object
* if it couldn't be found. Default null.
* @param string $table The name of the table being checked.
*/
$charset = apply_filters( 'pre_get_table_charset', null, $table );
if ( null !== $charset ) {
return $charset;
}
if ( isset( $this->table_charset[ $tablekey ] ) ) {
return $this->table_charset[ $tablekey ];
}
$charsets = array();
$columns = array();
$table_parts = explode( '.', $table );
$table = '`' . implode( '`.`', $table_parts ) . '`';
$results = $this->get_results( "SHOW FULL COLUMNS FROM $table" );
if ( ! $results ) {
return new WP_Error( 'wpdb_get_table_charset_failure', __( 'Could not retrieve table charset.' ) );
}
foreach ( $results as $column ) {
$columns[ strtolower( $column->Field ) ] = $column;
}
$this->col_meta[ $tablekey ] = $columns;
foreach ( $columns as $column ) {
if ( ! empty( $column->Collation ) ) {
list( $charset ) = explode( '_', $column->Collation );
$charsets[ strtolower( $charset ) ] = true;
}
list( $type ) = explode( '(', $column->Type );
// A binary/blob means the whole query gets treated like this.
if ( in_array( strtoupper( $type ), array( 'BINARY', 'VARBINARY', 'TINYBLOB', 'MEDIUMBLOB', 'BLOB', 'LONGBLOB' ), true ) ) {
$this->table_charset[ $tablekey ] = 'binary';
return 'binary';
}
}
// utf8mb3 is an alias for utf8.
if ( isset( $charsets['utf8mb3'] ) ) {
$charsets['utf8'] = true;
unset( $charsets['utf8mb3'] );
}
// Check if we have more than one charset in play.
$count = count( $charsets );
if ( 1 === $count ) {
$charset = key( $charsets );
} elseif ( 0 === $count ) {
// No charsets, assume this table can store whatever.
$charset = false;
} else {
// More than one charset. Remove latin1 if present and recalculate.
unset( $charsets['latin1'] );
$count = count( $charsets );
if ( 1 === $count ) {
// Only one charset (besides latin1).
$charset = key( $charsets );
} elseif ( 2 === $count && isset( $charsets['utf8'], $charsets['utf8mb4'] ) ) {
// Two charsets, but they're utf8 and utf8mb4, use utf8.
$charset = 'utf8';
} else {
// Two mixed character sets. ascii.
$charset = 'ascii';
}
}
$this->table_charset[ $tablekey ] = $charset;
return $charset;
}
/**
* Retrieves the character set for the given column.
*
* @since 4.2.0
*
* @param string $table Table name.
* @param string $column Column name.
* @return string|false|WP_Error Column character set as a string. False if the column has
* no character set. WP_Error object if there was an error.
*/
public function get_col_charset( $table, $column ) {
$tablekey = strtolower( $table );
$columnkey = strtolower( $column );
/**
* Filters the column charset value before the DB is checked.
*
* Passing a non-null value to the filter will short-circuit
* checking the DB for the charset, returning that value instead.
*
* @since 4.2.0
*
* @param string|null|false|WP_Error $charset The character set to use. Default null.
* @param string $table The name of the table being checked.
* @param string $column The name of the column being checked.
*/
$charset = apply_filters( 'pre_get_col_charset', null, $table, $column );
if ( null !== $charset ) {
return $charset;
}
// Skip this entirely if this isn't a MySQL database.
if ( empty( $this->is_mysql ) ) {
return false;
}
if ( empty( $this->table_charset[ $tablekey ] ) ) {
// This primes column information for us.
$table_charset = $this->get_table_charset( $table );
if ( is_wp_error( $table_charset ) ) {
return $table_charset;
}
}
// If still no column information, return the table charset.
if ( empty( $this->col_meta[ $tablekey ] ) ) {
return $this->table_charset[ $tablekey ];
}
// If this column doesn't exist, return the table charset.
if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
return $this->table_charset[ $tablekey ];
}
// Return false when it's not a string column.
if ( empty( $this->col_meta[ $tablekey ][ $columnkey ]->Collation ) ) {
return false;
}
list( $charset ) = explode( '_', $this->col_meta[ $tablekey ][ $columnkey ]->Collation );
return $charset;
}
/**
* Retrieves the maximum string length allowed in a given column.
*
* The length may either be specified as a byte length or a character length.
*
* @since 4.2.1
*
* @param string $table Table name.
* @param string $column Column name.
* @return array|false|WP_Error {
* Array of column length information, false if the column has no length (for
* example, numeric column), WP_Error object if there was an error.
*
* @type string $type One of 'byte' or 'char'.
* @type int $length The column length.
* }
*/
public function get_col_length( $table, $column ) {
$tablekey = strtolower( $table );
$columnkey = strtolower( $column );
// Skip this entirely if this isn't a MySQL database.
if ( empty( $this->is_mysql ) ) {
return false;
}
if ( empty( $this->col_meta[ $tablekey ] ) ) {
// This primes column information for us.
$table_charset = $this->get_table_charset( $table );
if ( is_wp_error( $table_charset ) ) {
return $table_charset;
}
}
if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
return false;
}
$typeinfo = explode( '(', $this->col_meta[ $tablekey ][ $columnkey ]->Type );
$type = strtolower( $typeinfo[0] );
if ( ! empty( $typeinfo[1] ) ) {
$length = trim( $typeinfo[1], ')' );
} else {
$length = false;
}
switch ( $type ) {
case 'char':
case 'varchar':
return array(
'type' => 'char',
'length' => (int) $length,
);
case 'binary':
case 'varbinary':
return array(
'type' => 'byte',
'length' => (int) $length,
);
case 'tinyblob':
case 'tinytext':
return array(
'type' => 'byte',
'length' => 255, // 2^8 - 1
);
case 'blob':
case 'text':
return array(
'type' => 'byte',
'length' => 65535, // 2^16 - 1
);
case 'mediumblob':
case 'mediumtext':
return array(
'type' => 'byte',
'length' => 16777215, // 2^24 - 1
);
case 'longblob':
case 'longtext':
return array(
'type' => 'byte',
'length' => 4294967295, // 2^32 - 1
);
default:
return false;
}
}
/**
* Checks if a string is ASCII.
*
* The negative regex is faster for non-ASCII strings, as it allows
* the search to finish as soon as it encounters a non-ASCII character.
*
* @since 4.2.0
*
* @param string $input_string String to check.
* @return bool True if ASCII, false if not.
*/
protected function check_ascii( $input_string ) {
if ( function_exists( 'mb_check_encoding' ) ) {
if ( mb_check_encoding( $input_string, 'ASCII' ) ) {
return true;
}
} elseif ( ! preg_match( '/[^\x00-\x7F]/', $input_string ) ) {
return true;
}
return false;
}
/**
* Checks if the query is accessing a collation considered safe on the current version of MySQL.
*
* @since 4.2.0
*
* @param string $query The query to check.
* @return bool True if the collation is safe, false if it isn't.
*/
protected function check_safe_collation( $query ) {
if ( $this->checking_collation ) {
return true;
}
// We don't need to check the collation for queries that don't read data.
$query = ltrim( $query, "\r\n\t (" );
if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $query ) ) {
return true;
}
// All-ASCII queries don't need extra checking.
if ( $this->check_ascii( $query ) ) {
return true;
}
$table = $this->get_table_from_query( $query );
if ( ! $table ) {
return false;
}
$this->checking_collation = true;
$collation = $this->get_table_charset( $table );
$this->checking_collation = false;
// Tables with no collation, or latin1 only, don't need extra checking.
if ( false === $collation || 'latin1' === $collation ) {
return true;
}
$table = strtolower( $table );
if ( empty( $this->col_meta[ $table ] ) ) {
return false;
}
// If any of the columns don't have one of these collations, it needs more confidence checking.
$safe_collations = array(
'utf8_bin',
'utf8_general_ci',
'utf8mb3_bin',
'utf8mb3_general_ci',
'utf8mb4_bin',
'utf8mb4_general_ci',
);
foreach ( $this->col_meta[ $table ] as $col ) {
if ( empty( $col->Collation ) ) {
continue;
}
if ( ! in_array( $col->Collation, $safe_collations, true ) ) {
return false;
}
}
return true;
}
/**
* Strips any invalid characters based on value/charset pairs.
*
* @since 4.2.0
*
* @param array $data Array of value arrays. Each value array has the keys 'value', 'charset', and 'length'.
* An optional 'ascii' key can be set to false to avoid redundant ASCII checks.
* @return array|WP_Error The $data parameter, with invalid characters removed from each value.
* This works as a passthrough: any additional keys such as 'field' are
* retained in each value array. If we cannot remove invalid characters,
* a WP_Error object is returned.
*/
protected function strip_invalid_text( $data ) {
$db_check_string = false;
foreach ( $data as &$value ) {
$charset = $value['charset'];
if ( is_array( $value['length'] ) ) {
$length = $value['length']['length'];
$truncate_by_byte_length = 'byte' === $value['length']['type'];
} else {
$length = false;
/*
* Since we have no length, we'll never truncate. Initialize the variable to false.
* True would take us through an unnecessary (for this case) codepath below.
*/
$truncate_by_byte_length = false;
}
// There's no charset to work with.
if ( false === $charset ) {
continue;
}
// Column isn't a string.
if ( ! is_string( $value['value'] ) ) {
continue;
}
$needs_validation = true;
if (
// latin1 can store any byte sequence.
'latin1' === $charset
||
// ASCII is always OK.
( ! isset( $value['ascii'] ) && $this->check_ascii( $value['value'] ) )
) {
$truncate_by_byte_length = true;
$needs_validation = false;
}
if ( $truncate_by_byte_length ) {
mbstring_binary_safe_encoding();
if ( false !== $length && strlen( $value['value'] ) > $length ) {
$value['value'] = substr( $value['value'], 0, $length );
}
reset_mbstring_encoding();
if ( ! $needs_validation ) {
continue;
}
}
// utf8 can be handled by regex, which is a bunch faster than a DB lookup.
if ( ( 'utf8' === $charset || 'utf8mb3' === $charset || 'utf8mb4' === $charset ) && function_exists( 'mb_strlen' ) ) {
$regex = '/
(
(?: [\x00-\x7F] # single-byte sequences 0xxxxxxx
| [\xC2-\xDF][\x80-\xBF] # double-byte sequences 110xxxxx 10xxxxxx
| \xE0[\xA0-\xBF][\x80-\xBF] # triple-byte sequences 1110xxxx 10xxxxxx * 2
| [\xE1-\xEC][\x80-\xBF]{2}
| \xED[\x80-\x9F][\x80-\xBF]
| [\xEE-\xEF][\x80-\xBF]{2}';
if ( 'utf8mb4' === $charset ) {
$regex .= '
| \xF0[\x90-\xBF][\x80-\xBF]{2} # four-byte sequences 11110xxx 10xxxxxx * 3
| [\xF1-\xF3][\x80-\xBF]{3}
| \xF4[\x80-\x8F][\x80-\xBF]{2}
';
}
$regex .= '){1,40} # ...one or more times
)
| . # anything else
/x';
$value['value'] = preg_replace( $regex, '$1', $value['value'] );
if ( false !== $length && mb_strlen( $value['value'], 'UTF-8' ) > $length ) {
$value['value'] = mb_substr( $value['value'], 0, $length, 'UTF-8' );
}
continue;
}
// We couldn't use any local conversions, send it to the DB.
$value['db'] = true;
$db_check_string = true;
}
unset( $value ); // Remove by reference.
if ( $db_check_string ) {
$queries = array();
foreach ( $data as $col => $value ) {
if ( ! empty( $value['db'] ) ) {
// We're going to need to truncate by characters or bytes, depending on the length value we have.
if ( isset( $value['length']['type'] ) && 'byte' === $value['length']['type'] ) {
// Using binary causes LEFT() to truncate by bytes.
$charset = 'binary';
} else {
$charset = $value['charset'];
}
if ( $this->charset ) {
$connection_charset = $this->charset;
} else {
$connection_charset = mysqli_character_set_name( $this->dbh );
}
if ( is_array( $value['length'] ) ) {
$length = sprintf( '%.0f', $value['length']['length'] );
$queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), $length ) USING $connection_charset )", $value['value'] );
} elseif ( 'binary' !== $charset ) {
// If we don't have a length, there's no need to convert binary - it will always return the same result.
$queries[ $col ] = $this->prepare( "CONVERT( CONVERT( %s USING $charset ) USING $connection_charset )", $value['value'] );
}
unset( $data[ $col ]['db'] );
}
}
$sql = array();
foreach ( $queries as $column => $query ) {
if ( ! $query ) {
continue;
}
$sql[] = $query . " AS x_$column";
}
$this->check_current_query = false;
$row = $this->get_row( 'SELECT ' . implode( ', ', $sql ), ARRAY_A );
if ( ! $row ) {
return new WP_Error( 'wpdb_strip_invalid_text_failure', __( 'Could not strip invalid text.' ) );
}
foreach ( array_keys( $data ) as $column ) {
if ( isset( $row[ "x_$column" ] ) ) {
$data[ $column ]['value'] = $row[ "x_$column" ];
}
}
}
return $data;
}
/**
* Strips any invalid characters from the query.
*
* @since 4.2.0
*
* @param string $query Query to convert.
* @return string|WP_Error The converted query, or a WP_Error object if the conversion fails.
*/
protected function strip_invalid_text_from_query( $query ) {
// We don't need to check the collation for queries that don't read data.
$trimmed_query = ltrim( $query, "\r\n\t (" );
if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $trimmed_query ) ) {
return $query;
}
$table = $this->get_table_from_query( $query );
if ( $table ) {
$charset = $this->get_table_charset( $table );
if ( is_wp_error( $charset ) ) {
return $charset;
}
// We can't reliably strip text from tables containing binary/blob columns.
if ( 'binary' === $charset ) {
return $query;
}
} else {
$charset = $this->charset;
}
$data = array(
'value' => $query,
'charset' => $charset,
'ascii' => false,
'length' => false,
);
$data = $this->strip_invalid_text( array( $data ) );
if ( is_wp_error( $data ) ) {
return $data;
}
return $data[0]['value'];
}
/**
* Strips any invalid characters from the string for a given table and column.
*
* @since 4.2.0
*
* @param string $table Table name.
* @param string $column Column name.
* @param string $value The text to check.
* @return string|WP_Error The converted string, or a WP_Error object if the conversion fails.
*/
public function strip_invalid_text_for_column( $table, $column, $value ) {
if ( ! is_string( $value ) ) {
return $value;
}
$charset = $this->get_col_charset( $table, $column );
if ( ! $charset ) {
// Not a string column.
return $value;
} elseif ( is_wp_error( $charset ) ) {
// Bail on real errors.
return $charset;
}
$data = array(
$column => array(
'value' => $value,
'charset' => $charset,
'length' => $this->get_col_length( $table, $column ),
),
);
$data = $this->strip_invalid_text( $data );
if ( is_wp_error( $data ) ) {
return $data;
}
return $data[ $column ]['value'];
}
/**
* Finds the first table name referenced in a query.
*
* @since 4.2.0
*
* @param string $query The query to search.
* @return string|false The table name found, or false if a table couldn't be found.
*/
protected function get_table_from_query( $query ) {
// Remove characters that can legally trail the table name.
$query = rtrim( $query, ';/-#' );
// Allow (select...) union [...] style queries. Use the first query's table name.
$query = ltrim( $query, "\r\n\t (" );
// Strip everything between parentheses except nested selects.
$query = preg_replace( '/\((?!\s*select)[^(]*?\)/is', '()', $query );
// Quickly match most common queries.
if ( preg_match(
'/^\s*(?:'
. 'SELECT.*?\s+FROM'
. '|INSERT(?:\s+LOW_PRIORITY|\s+DELAYED|\s+HIGH_PRIORITY)?(?:\s+IGNORE)?(?:\s+INTO)?'
. '|REPLACE(?:\s+LOW_PRIORITY|\s+DELAYED)?(?:\s+INTO)?'
. '|UPDATE(?:\s+LOW_PRIORITY)?(?:\s+IGNORE)?'
. '|DELETE(?:\s+LOW_PRIORITY|\s+QUICK|\s+IGNORE)*(?:.+?FROM)?'
. ')\s+((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)/is',
$query,
$maybe
) ) {
return str_replace( '`', '', $maybe[1] );
}
// SHOW TABLE STATUS and SHOW TABLES WHERE Name = 'wp_posts'
if ( preg_match( '/^\s*SHOW\s+(?:TABLE\s+STATUS|(?:FULL\s+)?TABLES).+WHERE\s+Name\s*=\s*("|\')((?:[0-9a-zA-Z$_.-]|[\xC2-\xDF][\x80-\xBF])+)\\1/is', $query, $maybe ) ) {
return $maybe[2];
}
/*
* SHOW TABLE STATUS LIKE and SHOW TABLES LIKE 'wp\_123\_%'
* This quoted LIKE operand seldom holds a full table name.
* It is usually a pattern for matching a prefix so we just
* strip the trailing % and unescape the _ to get 'wp_123_'
* which drop-ins can use for routing these SQL statements.
*/
if ( preg_match( '/^\s*SHOW\s+(?:TABLE\s+STATUS|(?:FULL\s+)?TABLES)\s+(?:WHERE\s+Name\s+)?LIKE\s*("|\')((?:[\\\\0-9a-zA-Z$_.-]|[\xC2-\xDF][\x80-\xBF])+)%?\\1/is', $query, $maybe ) ) {
return str_replace( '\\_', '_', $maybe[2] );
}
// Big pattern for the rest of the table-related queries.
if ( preg_match(
'/^\s*(?:'
. '(?:EXPLAIN\s+(?:EXTENDED\s+)?)?SELECT.*?\s+FROM'
. '|DESCRIBE|DESC|EXPLAIN|HANDLER'
. '|(?:LOCK|UNLOCK)\s+TABLE(?:S)?'
. '|(?:RENAME|OPTIMIZE|BACKUP|RESTORE|CHECK|CHECKSUM|ANALYZE|REPAIR).*\s+TABLE'
. '|TRUNCATE(?:\s+TABLE)?'
. '|CREATE(?:\s+TEMPORARY)?\s+TABLE(?:\s+IF\s+NOT\s+EXISTS)?'
. '|ALTER(?:\s+IGNORE)?\s+TABLE'
. '|DROP\s+TABLE(?:\s+IF\s+EXISTS)?'
. '|CREATE(?:\s+\w+)?\s+INDEX.*\s+ON'
. '|DROP\s+INDEX.*\s+ON'
. '|LOAD\s+DATA.*INFILE.*INTO\s+TABLE'
. '|(?:GRANT|REVOKE).*ON\s+TABLE'
. '|SHOW\s+(?:.*FROM|.*TABLE)'
. ')\s+\(*\s*((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)\s*\)*/is',
$query,
$maybe
) ) {
return str_replace( '`', '', $maybe[1] );
}
return false;
}
/**
* Loads the column metadata from the last query.
*
* @since 3.5.0
*/
protected function load_col_info() {
if ( $this->col_info ) {
return;
}
$num_fields = mysqli_num_fields( $this->result );
for ( $i = 0; $i < $num_fields; $i++ ) {
$this->col_info[ $i ] = mysqli_fetch_field( $this->result );
}
}
/**
* Retrieves column metadata from the last query.
*
* @since 0.71
*
* @param string $info_type Optional. Possible values include 'name', 'table', 'def', 'max_length',
* 'not_null', 'primary_key', 'multiple_key', 'unique_key', 'numeric',
* 'blob', 'type', 'unsigned', 'zerofill'. Default 'name'.
* @param int $col_offset Optional. 0: col name. 1: which table the col's in. 2: col's max length.
* 3: if the col is numeric. 4: col's type. Default -1.
* @return mixed Column results.
*/
public function get_col_info( $info_type = 'name', $col_offset = -1 ) {
$this->load_col_info();
if ( $this->col_info ) {
if ( -1 === $col_offset ) {
$i = 0;
$new_array = array();
foreach ( (array) $this->col_info as $col ) {
$new_array[ $i ] = $col->{$info_type};
++$i;
}
return $new_array;
} else {
return $this->col_info[ $col_offset ]->{$info_type};
}
}
}
/**
* Starts the timer, for debugging purposes.
*
* @since 1.5.0
*
* @return true
*/
public function timer_start() {
$this->time_start = microtime( true );
return true;
}
/**
* Stops the debugging timer.
*
* @since 1.5.0
*
* @return float Total time spent on the query, in seconds.
*/
public function timer_stop() {
return ( microtime( true ) - $this->time_start );
}
/**
* Wraps errors in a nice header and footer and dies.
*
* Will not die if wpdb::$show_errors is false.
*
* @since 1.5.0
*
* @param string $message The error message.
* @param string $error_code Optional. A computer-readable string to identify the error.
* Default '500'.
* @return void|false Void if the showing of errors is enabled, false if disabled.
*/
public function bail( $message, $error_code = '500' ) {
if ( $this->show_errors ) {
$error = '';
if ( $this->dbh instanceof mysqli ) {
$error = mysqli_error( $this->dbh );
} elseif ( mysqli_connect_errno() ) {
$error = mysqli_connect_error();
}
if ( $error ) {
$message = '' . $error . "
\n" . $message;
}
wp_die( $message );
} else {
if ( class_exists( 'WP_Error', false ) ) {
$this->error = new WP_Error( $error_code, $message );
} else {
$this->error = $message;
}
return false;
}
}
/**
* Closes the current database connection.
*
* @since 4.5.0
*
* @return bool True if the connection was successfully closed,
* false if it wasn't, or if the connection doesn't exist.
*/
public function close() {
if ( ! $this->dbh ) {
return false;
}
$closed = mysqli_close( $this->dbh );
if ( $closed ) {
$this->dbh = null;
$this->ready = false;
$this->has_connected = false;
}
return $closed;
}
/**
* Determines whether MySQL database is at least the required minimum version.
*
* @since 2.5.0
*
* @global string $required_mysql_version The required MySQL version string.
* @return void|WP_Error
*/
public function check_database_version() {
global $required_mysql_version;
$wp_version = wp_get_wp_version();
// Make sure the server has the required MySQL version.
if ( version_compare( $this->db_version(), $required_mysql_version, '<' ) ) {
/* translators: 1: WordPress version number, 2: Minimum required MySQL version number. */
return new WP_Error( 'database_version', sprintf( __( 'Error: WordPress %1$s requires MySQL %2$s or higher' ), $wp_version, $required_mysql_version ) );
}
}
/**
* Determines whether the database supports collation.
*
* Called when WordPress is generating the table scheme.
*
* Use `wpdb::has_cap( 'collation' )`.
*
* @since 2.5.0
* @deprecated 3.5.0 Use wpdb::has_cap()
*
* @return bool True if collation is supported, false if not.
*/
public function supports_collation() {
_deprecated_function( __FUNCTION__, '3.5.0', 'wpdb::has_cap( \'collation\' )' );
return $this->has_cap( 'collation' );
}
/**
* Retrieves the database character collate.
*
* @since 3.5.0
*
* @return string The database character collate.
*/
public function get_charset_collate() {
$charset_collate = '';
if ( ! empty( $this->charset ) ) {
$charset_collate = "DEFAULT CHARACTER SET $this->charset";
}
if ( ! empty( $this->collate ) ) {
$charset_collate .= " COLLATE $this->collate";
}
return $charset_collate;
}
/**
* Determines whether the database or WPDB supports a particular feature.
*
* Capability sniffs for the database server and current version of WPDB.
*
* Database sniffs are based on the version of MySQL the site is using.
*
* WPDB sniffs are added as new features are introduced to allow theme and plugin
* developers to determine feature support. This is to account for drop-ins which may
* introduce feature support at a different time to WordPress.
*
* @since 2.7.0
* @since 4.1.0 Added support for the 'utf8mb4' feature.
* @since 4.6.0 Added support for the 'utf8mb4_520' feature.
* @since 6.2.0 Added support for the 'identifier_placeholders' feature.
* @since 6.6.0 The `utf8mb4` feature now always returns true.
*
* @see wpdb::db_version()
*
* @param string $db_cap The feature to check for. Accepts 'collation', 'group_concat',
* 'subqueries', 'set_charset', 'utf8mb4', 'utf8mb4_520',
* or 'identifier_placeholders'.
* @return bool True when the database feature is supported, false otherwise.
*/
public function has_cap( $db_cap ) {
$db_version = $this->db_version();
$db_server_info = $this->db_server_info();
/*
* Account for MariaDB version being prefixed with '5.5.5-' on older PHP versions.
*
* Note: str_contains() is not used here, as this file can be included
* directly outside of WordPress core, e.g. by HyperDB, in which case
* the polyfills from wp-includes/compat.php are not loaded.
*/
if ( '5.5.5' === $db_version && false !== strpos( $db_server_info, 'MariaDB' )
&& PHP_VERSION_ID < 80016 // PHP 8.0.15 or older.
) {
// Strip the '5.5.5-' prefix and set the version to the correct value.
$db_server_info = preg_replace( '/^5\.5\.5-(.*)/', '$1', $db_server_info );
$db_version = preg_replace( '/[^0-9.].*/', '', $db_server_info );
}
switch ( strtolower( $db_cap ) ) {
case 'collation': // @since 2.5.0
case 'group_concat': // @since 2.7.0
case 'subqueries': // @since 2.7.0
return version_compare( $db_version, '4.1', '>=' );
case 'set_charset':
return version_compare( $db_version, '5.0.7', '>=' );
case 'utf8mb4': // @since 4.1.0
return true;
case 'utf8mb4_520': // @since 4.6.0
return version_compare( $db_version, '5.6', '>=' );
case 'identifier_placeholders': // @since 6.2.0
/*
* As of WordPress 6.2, wpdb::prepare() supports identifiers via '%i',
* e.g. table/field names.
*/
return true;
}
return false;
}
/**
* Retrieves a comma-separated list of the names of the functions that called wpdb.
*
* @since 2.5.0
*
* @return string Comma-separated list of the calling functions.
*/
public function get_caller() {
return wp_debug_backtrace_summary( __CLASS__ );
}
/**
* Retrieves the database server version.
*
* @since 2.7.0
*
* @return string|null Version number on success, null on failure.
*/
public function db_version() {
return preg_replace( '/[^0-9.].*/', '', $this->db_server_info() );
}
/**
* Returns the version of the MySQL server.
*
* @since 5.5.0
*
* @return string Server version as a string.
*/
public function db_server_info() {
return mysqli_get_server_info( $this->dbh );
}
}