All respect to reviewers but some things do not really make sense!

Envato Authors Code Authors
1

Hello,

So I have had an item soft rejected again because I need to prepare all SQL queries. However, one of the queries that the review team wants me to prepare has no “Unknown variables”

An example for one of the warnings:

$count = $wpdb->get_var( "SELECT COUNT(key_id) FROM {$wpdb->prefix}userisle_api_keys WHERE 1 = 1;" );

Maybe someone with a better understanding of WordPress code standards can tell me how to prepare this statement? It has no variables! It is just counting all keys from the table. But the review team include this to me and want me to prepare it? WordPress prepare function requires 2 arguments, with the second argument containing variables.

I’m really confused. In another scenario, one of the warnings is to prepare:

$count = $wpdb->get_var( "SELECT COUNT(key_id) FROM {$wpdb->prefix}userisle_api_keys WHERE 1 = 1 {$search};" );

Yes, $search is a variable. But a few lines before that line, you can see that:

$search = '';

if ( ! empty( $_REQUEST['s'] ) ) {
    $search = "AND description LIKE '%" . esc_sql( $wpdb->esc_like( wui_clean( wp_unslash( $_REQUEST['s'] ) ) ) ) . "%' ";
}

It’s escaped. Following WordPress coding standards. I mean, seriously?

Maybe someone can help me prepare these statements? WordPress itself does not prepare statements where there’s no unknown variables.

Best,
Ahmed

2

Hi

Hope this will help you:
https://developer.wordpress.org/reference/classes/wpdb/prepare/

Thanks

3

Thanks for the link, I already know how to prepare SQL queries.

$wpdb->prepare is used when there is unknown variable in the query. but for a query like this

$count = $wpdb->get_var( "SELECT COUNT(key_id) FROM {$wpdb->prefix}userisle_api_keys WHERE 1 = 1;" );

Can you tell me how you prepare it? Please do not write to me the same link, because it was not designed for this purpose, the whole point of wpdb::prepare is to sanitize unknown data.

Can you tell me which data needs to be sanitized in the above query? Simple question.

Best,
Ahmed

4

Hi

The best practice is to always use prepare in all of your SQL query for safe execution. The main use of prepare is to prevent against SQL injection attacks. and to meet current Updated Wordpress Requirements reviewer will request you to use prepare. But if you need more clearification then wait for more experienced programmer in the forum or contact Envato Support for your concern.

Thanks

5

Thanks for your time.

Yes, I’m going to escalate this to Envato support because I can’t understand a thing.

Best,
Ahmed

6

sure, also you can share the answer here when you will get. Thanks