vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-04-01 03:04:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Database: Hardening for wpdb::prepare()

Browse Source 
Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.



git-svn-id: https://develop.svn.wordpress.org/trunk@41470 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
aaroncampbell
2017-09-19 14:47:46 +00:00
parent 64e8c4952a
commit eb012314d0
2 changed files with 50 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tests/phpunit/tests/db.php
View File

@@ -354,6 +354,46 @@ class Tests_DB extends WP_UnitTestCase {
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0", $prepared );
}
function test_prepare_sprintf() {
global $wpdb;
$prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, "admin" );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
}
/**
* @expectedIncorrectUsage wpdb::prepare
*/
function test_prepare_sprintf_invalid_args() {
global $wpdb;
$prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", 1, array( "admin" ) );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
$prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1 ), "admin" );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
}
function test_prepare_vsprintf() {
global $wpdb;
$prepared = $wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, "admin" ) );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = 'admin'", $prepared );
}
/**
* @expectedIncorrectUsage wpdb::prepare
*/
function test_prepare_vsprintf_invalid_args() {
global $wpdb;
$prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( 1, array( "admin" ) ) );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 1 AND user_login = ''", $prepared );
$prepared = @$wpdb->prepare( "SELECT * FROM $wpdb->users WHERE id = %d AND user_login = %s", array( array( 1 ), "admin" ) );
$this->assertEquals( "SELECT * FROM $wpdb->users WHERE id = 0 AND user_login = 'admin'", $prepared );
}
function test_db_version() {
global $wpdb;