X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/1132430022383fdf47fa6cb9377300fd885297aa..dc1231b7312fbdca99e9e887cc2bb35a28f85cdc:/wp-includes/wp-db.php diff --git a/wp-includes/wp-db.php b/wp-includes/wp-db.php index b3eed896..759baaae 100644 --- a/wp-includes/wp-db.php +++ b/wp-includes/wp-db.php @@ -43,7 +43,7 @@ define( 'ARRAY_N', 'ARRAY_N' ); * file to your class. The wpdb class will still be included, * so you can extend it or simply use your own. * - * @link http://codex.wordpress.org/Function_Reference/wpdb_Class + * @link https://codex.wordpress.org/Function_Reference/wpdb_Class * * @package WordPress * @subpackage Database @@ -84,19 +84,19 @@ class wpdb { * Amount of queries made * * @since 1.2.0 - * @access private + * @access public * @var int */ - var $num_queries = 0; + public $num_queries = 0; /** * Count of rows returned by previous query * * @since 0.71 - * @access private + * @access public * @var int */ - var $num_rows = 0; + public $num_rows = 0; /** * Count of affected rows by previous query @@ -114,7 +114,7 @@ class wpdb { * @access public * @var int */ - var $insert_id = 0; + public $insert_id = 0; /** * Last query made @@ -176,7 +176,7 @@ class wpdb { * @since 4.2.0 * @access private * @see wpdb::check_safe_collation() - * @var boolean + * @var bool */ private $checking_collation = false; @@ -216,10 +216,10 @@ class wpdb { * security precautions. * * @since 2.5.0 - * @access private + * @access public * @var string */ - var $prefix = ''; + public $prefix = ''; /** * WordPress base table prefix. @@ -240,7 +240,7 @@ class wpdb { var $ready = false; /** - * {@internal Missing Description}} + * Blog ID. * * @since 3.0.0 * @access public @@ -249,7 +249,7 @@ class wpdb { public $blogid = 0; /** - * {@internal Missing Description}} + * Site ID. * * @since 3.0.0 * @access public @@ -607,10 +607,12 @@ class wpdb { * @link https://core.trac.wordpress.org/ticket/3354 * @since 2.0.8 * - * @param string $dbuser MySQL database user + * @global string $wp_version + * + * @param string $dbuser MySQL database user * @param string $dbpassword MySQL database password - * @param string $dbname MySQL database name - * @param string $dbhost MySQL database host + * @param string $dbname MySQL database name + * @param string $dbhost MySQL database host */ public function __construct( $dbuser, $dbpassword, $dbname, $dbhost ) { register_shutdown_function( array( $this, '__destruct' ) ); @@ -634,8 +636,6 @@ class wpdb { } } - $this->init_charset(); - $this->dbuser = $dbuser; $this->dbpassword = $dbpassword; $this->dbname = $dbname; @@ -654,7 +654,7 @@ class wpdb { * * @see wpdb::__construct() * @since 2.0.8 - * @return bool true + * @return true */ public function __destruct() { return true; @@ -727,16 +727,30 @@ class wpdb { public function init_charset() { if ( function_exists('is_multisite') && is_multisite() ) { $this->charset = 'utf8'; - if ( defined( 'DB_COLLATE' ) && DB_COLLATE ) + if ( defined( 'DB_COLLATE' ) && DB_COLLATE ) { $this->collate = DB_COLLATE; - else + } else { $this->collate = 'utf8_general_ci'; + } } elseif ( defined( 'DB_COLLATE' ) ) { $this->collate = DB_COLLATE; } - if ( defined( 'DB_CHARSET' ) ) + if ( defined( 'DB_CHARSET' ) ) { $this->charset = DB_CHARSET; + } + + if ( ( $this->use_mysqli && ! ( $this->dbh instanceof mysqli ) ) || empty( $this->dbh ) ) { + return; + } + + if ( 'utf8' === $this->charset && $this->has_cap( 'utf8mb4' ) ) { + $this->charset = 'utf8mb4'; + } + + if ( 'utf8mb4' === $this->charset && ( ! $this->collate || stripos( $this->collate, 'utf8_' ) === 0 ) ) { + $this->collate = 'utf8mb4_unicode_ci'; + } } /** @@ -846,8 +860,8 @@ class wpdb { * * @since 2.5.0 * - * @param string $prefix Alphanumeric name for the new prefix. - * @param bool $set_table_names Optional. Whether the table names, e.g. wpdb::$posts, should be updated or not. + * @param string $prefix Alphanumeric name for the new prefix. + * @param bool $set_table_names Optional. Whether the table names, e.g. wpdb::$posts, should be updated or not. * @return string|WP_Error Old prefix or WP_Error on error */ public function set_prefix( $prefix, $set_table_names = true ) { @@ -885,6 +899,7 @@ class wpdb { * * @since 3.0.0 * @access public + * * @param int $blog_id * @param int $site_id Optional. * @return int previous blog id @@ -949,10 +964,10 @@ class wpdb { * @uses wpdb::$global_tables * @uses wpdb::$ms_global_tables * - * @param string $scope Optional. Can be all, global, ms_global, blog, or old tables. Defaults to all. - * @param bool $prefix Optional. Whether to include table prefixes. Default true. If blog - * prefix is requested, then the custom users and usermeta tables will be mapped. - * @param int $blog_id Optional. The blog_id to prefix. Defaults to wpdb::$blogid. Used only when prefix is requested. + * @param string $scope Optional. Can be all, global, ms_global, blog, or old tables. Defaults to all. + * @param bool $prefix Optional. Whether to include table prefixes. Default true. If blog + * prefix is requested, then the custom users and usermeta tables will be mapped. + * @param int $blog_id Optional. The blog_id to prefix. Defaults to wpdb::$blogid. Used only when prefix is requested. * @return array Table names. When a prefix is requested, the key is the unprefixed table name. */ public function tables( $scope = 'all', $prefix = true, $blog_id = 0 ) { @@ -1012,9 +1027,8 @@ class wpdb { * * @since 0.71 * - * @param string $db MySQL database name - * @param resource $dbh Optional link identifier. - * @return null Always null. + * @param string $db MySQL database name + * @param resource|null $dbh Optional link identifier. */ public function select( $db, $dbh = null ) { if ( is_null($dbh) ) @@ -1038,7 +1052,6 @@ class wpdb {

If you don\'t know how to set up a database you should contact your host. If all else fails you may find help at the WordPress Support Forums.

' ), htmlspecialchars( $db, ENT_QUOTES ), htmlspecialchars( $this->dbuser, ENT_QUOTES ) ), 'db_select_fail' ); } - return; } } @@ -1150,9 +1163,10 @@ class wpdb { * Escapes content by reference for insertion into the database, for security * * @uses wpdb::_real_escape() + * * @since 2.3.0 + * * @param string $string to escape - * @return void */ public function escape_by_ref( &$string ) { if ( ! is_float( $string ) ) @@ -1185,14 +1199,13 @@ class wpdb { * @link http://php.net/sprintf Description of syntax. * @since 2.3.0 * - * @param string $query Query statement with sprintf()-like placeholders - * @param array|mixed $args The array of variables to substitute into the query's placeholders if being called like - * {@link http://php.net/vsprintf vsprintf()}, or the first variable to substitute into the query's placeholders if - * being called like {@link http://php.net/sprintf sprintf()}. - * @param mixed $args,... further variables to substitute into the query's placeholders if being called like - * {@link http://php.net/sprintf sprintf()}. - * @return null|false|string Sanitized query string, null if there is no query, false if there is an error and string - * if there was something to prepare + * @param string $query Query statement with sprintf()-like placeholders + * @param array|mixed $args The array of variables to substitute into the query's placeholders if being called like + * {@link http://php.net/vsprintf vsprintf()}, or the first variable to substitute into the query's placeholders if + * being called like {@link http://php.net/sprintf sprintf()}. + * @param mixed $args,... further variables to substitute into the query's placeholders if being called like + * {@link http://php.net/sprintf sprintf()}. + * @return string|void Sanitized query string, if there is a query to prepare. */ public function prepare( $query, $args ) { if ( is_null( $query ) ) @@ -1249,7 +1262,7 @@ class wpdb { * @global array $EZSQL_ERROR Stores error information of query and error string * * @param string $str The error to display - * @return false|null False if the showing of errors is disabled. + * @return false|void False if the showing of errors is disabled. */ public function print_error( $str = '' ) { global $EZSQL_ERROR; @@ -1281,19 +1294,29 @@ class wpdb { // If there is an error then take note of it if ( is_multisite() ) { - $msg = "WordPress database error: [$str]\n{$this->last_query}\n"; - if ( defined( 'ERRORLOGFILE' ) ) + $msg = sprintf( + "%s [%s]\n%s\n", + __( 'WordPress database error:' ), + $str, + $this->last_query + ); + + if ( defined( 'ERRORLOGFILE' ) ) { error_log( $msg, 3, ERRORLOGFILE ); - if ( defined( 'DIEONDBERROR' ) ) + } + if ( defined( 'DIEONDBERROR' ) ) { wp_die( $msg ); + } } else { $str = htmlspecialchars( $str, ENT_QUOTES ); $query = htmlspecialchars( $this->last_query, ENT_QUOTES ); - print "
-

WordPress database error: [$str]
- $query

-
"; + printf( + '

%s [%s]
%s

', + __( 'WordPress database error:' ), + $str, + $query + ); } } @@ -1354,7 +1377,6 @@ class wpdb { * Kill cached query results. * * @since 0.71 - * @return void */ public function flush() { $this->last_result = array(); @@ -1376,7 +1398,7 @@ class wpdb { while ( mysqli_more_results( $this->dbh ) ) { mysqli_next_result( $this->dbh ); } - } else if ( is_resource( $this->result ) ) { + } elseif ( is_resource( $this->result ) ) { mysql_free_result( $this->result ); } } @@ -1391,10 +1413,9 @@ class wpdb { * @since 3.9.0 $allow_bail parameter added. * * @param bool $allow_bail Optional. Allows the function to bail. Default true. - * @return null|bool True with a successful connection, false on failure. + * @return bool True with a successful connection, false on failure. */ public function db_connect( $allow_bail = true ) { - $this->is_mysql = true; /* @@ -1445,9 +1466,9 @@ class wpdb { if ( $this->has_connected ) { $attempt_fallback = false; - } else if ( defined( 'WP_USE_EXT_MYSQL' ) && ! WP_USE_EXT_MYSQL ) { + } elseif ( defined( 'WP_USE_EXT_MYSQL' ) && ! WP_USE_EXT_MYSQL ) { $attempt_fallback = false; - } else if ( ! function_exists( 'mysql_connect' ) ) { + } elseif ( ! function_exists( 'mysql_connect' ) ) { $attempt_fallback = false; } @@ -1485,11 +1506,17 @@ class wpdb { " ), htmlspecialchars( $this->dbhost, ENT_QUOTES ) ), 'db_connect_fail' ); return false; - } else if ( $this->dbh ) { + } elseif ( $this->dbh ) { + if ( ! $this->has_connected ) { + $this->init_charset(); + } + $this->has_connected = true; + $this->set_charset( $this->dbh ); - $this->set_sql_mode(); + $this->ready = true; + $this->set_sql_mode(); $this->select( $this->dbname, $this->dbh ); return true; @@ -1510,7 +1537,7 @@ class wpdb { * @since 3.9.0 * * @param bool $allow_bail Optional. Allows the function to bail. Default true. - * @return bool|null True if the connection is up. + * @return bool|void True if the connection is up. */ public function check_connection( $allow_bail = true ) { if ( $this->use_mysqli ) { @@ -1620,6 +1647,7 @@ class wpdb { } $this->check_current_query = true; + // Keep track of the last query for debug.. $this->last_query = $query; @@ -1685,7 +1713,7 @@ class wpdb { $this->last_result[$num_rows] = $row; $num_rows++; } - } else if ( is_resource( $this->result ) ) { + } elseif ( is_resource( $this->result ) ) { while ( $row = @mysql_fetch_object( $this->result ) ) { $this->last_result[$num_rows] = $row; $num_rows++; @@ -1739,10 +1767,13 @@ class wpdb { * @see wpdb::$field_types * @see wp_set_wpdb_vars() * - * @param string $table table name - * @param array $data Data to insert (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped). - * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. If string, that format will be used for all of the values in $data. - * A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. + * @param string $table Table name + * @param array $data Data to insert (in column => value pairs). + * Both $data columns and $data values should be "raw" (neither should be SQL escaped). + * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. + * If string, that format will be used for all of the values in $data. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. * @return int|false The number of rows inserted, or false on error. */ public function insert( $table, $data, $format = null ) { @@ -1760,10 +1791,13 @@ class wpdb { * @see wpdb::$field_types * @see wp_set_wpdb_vars() * - * @param string $table table name - * @param array $data Data to insert (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped). - * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. If string, that format will be used for all of the values in $data. - * A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. + * @param string $table Table name + * @param array $data Data to insert (in column => value pairs). + * Both $data columns and $data values should be "raw" (neither should be SQL escaped). + * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. + * If string, that format will be used for all of the values in $data. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. * @return int|false The number of rows affected, or false on error. */ public function replace( $table, $data, $format = null ) { @@ -1781,14 +1815,19 @@ class wpdb { * @see wpdb::$field_types * @see wp_set_wpdb_vars() * - * @param string $table table name - * @param array $data Data to insert (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped). - * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. If string, that format will be used for all of the values in $data. - * A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. - * @param string $type Optional. What type of operation is this? INSERT or REPLACE. Defaults to INSERT. + * @param string $table Table name + * @param array $data Data to insert (in column => value pairs). + * Both $data columns and $data values should be "raw" (neither should be SQL escaped). + * @param array|string $format Optional. An array of formats to be mapped to each of the value in $data. + * If string, that format will be used for all of the values in $data. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. + * @param string $type Optional. What type of operation is this? INSERT or REPLACE. Defaults to INSERT. * @return int|false The number of rows affected, or false on error. */ function _insert_replace_helper( $table, $data, $format = null, $type = 'INSERT' ) { + $this->insert_id = 0; + if ( ! in_array( strtoupper( $type ), array( 'REPLACE', 'INSERT' ) ) ) { return false; } @@ -1809,7 +1848,6 @@ class wpdb { $sql = "$type INTO `$table` ($fields) VALUES ($formats)"; - $this->insert_id = 0; $this->check_current_query = false; return $this->query( $this->prepare( $sql, $values ) ); } @@ -1825,12 +1863,20 @@ class wpdb { * @see wpdb::$field_types * @see wp_set_wpdb_vars() * - * @param string $table table name - * @param array $data Data to update (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped). - * @param array $where A named array of WHERE clauses (in column => value pairs). Multiple clauses will be joined with ANDs. Both $where columns and $where values should be "raw". - * @param array|string $format Optional. An array of formats to be mapped to each of the values in $data. If string, that format will be used for all of the values in $data. - * A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. - * @param array|string $where_format Optional. An array of formats to be mapped to each of the values in $where. If string, that format will be used for all of the items in $where. A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $where will be treated as strings. + * @param string $table Table name + * @param array $data Data to update (in column => value pairs). + * Both $data columns and $data values should be "raw" (neither should be SQL escaped). + * @param array $where A named array of WHERE clauses (in column => value pairs). + * Multiple clauses will be joined with ANDs. + * Both $where columns and $where values should be "raw". + * @param array|string $format Optional. An array of formats to be mapped to each of the values in $data. + * If string, that format will be used for all of the values in $data. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $data will be treated as strings unless otherwise specified in wpdb::$field_types. + * @param array|string $where_format Optional. An array of formats to be mapped to each of the values in $where. + * If string, that format will be used for all of the items in $where. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $where will be treated as strings. * @return int|false The number of rows updated, or false on error. */ public function update( $table, $data, $where, $format = null, $where_format = null ) { @@ -1877,9 +1923,14 @@ class wpdb { * @see wpdb::$field_types * @see wp_set_wpdb_vars() * - * @param string $table table name - * @param array $where A named array of WHERE clauses (in column => value pairs). Multiple clauses will be joined with ANDs. Both $where columns and $where values should be "raw". - * @param array|string $where_format Optional. An array of formats to be mapped to each of the values in $where. If string, that format will be used for all of the items in $where. A format is one of '%d', '%f', '%s' (integer, float, string). If omitted, all values in $where will be treated as strings unless otherwise specified in wpdb::$field_types. + * @param string $table Table name + * @param array $where A named array of WHERE clauses (in column => value pairs). + * Multiple clauses will be joined with ANDs. + * Both $where columns and $where values should be "raw". + * @param array|string $where_format Optional. An array of formats to be mapped to each of the values in $where. + * If string, that format will be used for all of the items in $where. + * A format is one of '%d', '%f', '%s' (integer, float, string). + * If omitted, all values in $where will be treated as strings unless otherwise specified in wpdb::$field_types. * @return int|false The number of rows updated, or false on error. */ public function delete( $table, $where, $where_format = null ) { @@ -1921,16 +1972,25 @@ class wpdb { * @param string $table Table name. * @param array $data Field/value pair. * @param mixed $format Format for each field. - * @return array|bool Returns an array of fields that contain paired values + * @return array|false Returns an array of fields that contain paired values * and formats. Returns false for invalid values. */ protected function process_fields( $table, $data, $format ) { $data = $this->process_field_formats( $data, $format ); + if ( false === $data ) { + return false; + } + $data = $this->process_field_charsets( $data, $table ); if ( false === $data ) { return false; } + $data = $this->process_field_lengths( $data, $table ); + if ( false === $data ) { + return false; + } + $converted_data = $this->strip_invalid_text( $data ); if ( $data !== $converted_data ) { @@ -1977,14 +2037,14 @@ class wpdb { /** * Adds field charsets to field/value/format arrays generated by - * the {@see wpdb::process_field_formats()} method. + * the wpdb::process_field_formats() method. * * @since 4.2.0 * @access protected * - * @param array $data As it comes from the {@see wpdb::process_field_formats()} method. + * @param array $data As it comes from the wpdb::process_field_formats() method. * @param string $table Table name. - * @return The same array as $data with additional 'charset' keys. + * @return array|false The same array as $data with additional 'charset' keys. */ protected function process_field_charsets( $data, $table ) { foreach ( $data as $field => $value ) { @@ -1992,17 +2052,41 @@ class wpdb { // We can skip this field if we know it isn't a string. // This checks %d/%f versus ! %s because it's sprintf() could take more. $value['charset'] = false; - } elseif ( $this->check_ascii( $value['value'] ) ) { - // If it's ASCII, then we don't need the charset. We can skip this field. - $value['charset'] = false; } else { $value['charset'] = $this->get_col_charset( $table, $field ); if ( is_wp_error( $value['charset'] ) ) { return false; } + } + + $data[ $field ] = $value; + } + + return $data; + } - // This isn't ASCII. Don't have strip_invalid_text() re-check. - $value['ascii'] = false; + /** + * For string fields, record the maximum string length that field can safely save. + * + * @since 4.2.1 + * @access protected + * + * @param array $data As it comes from the wpdb::process_field_charsets() method. + * @param string $table Table name. + * @return array|false The same array as $data with additional 'length' keys, or false if + * any of the values were too long for their corresponding field. + */ + protected function process_field_lengths( $data, $table ) { + foreach ( $data as $field => $value ) { + if ( '%d' === $value['format'] || '%f' === $value['format'] ) { + // We can skip this field if we know it isn't a string. + // This checks %d/%f versus ! %s because it's sprintf() could take more. + $value['length'] = false; + } else { + $value['length'] = $this->get_col_length( $table, $field ); + if ( is_wp_error( $value['length'] ) ) { + return false; + } } $data[ $field ] = $value; @@ -2021,14 +2105,14 @@ class wpdb { * @since 0.71 * * @param string|null $query Optional. SQL query. Defaults to null, use the result from the previous query. - * @param int $x Optional. Column of value to return. Indexed from 0. - * @param int $y Optional. Row of value to return. Indexed from 0. + * @param int $x Optional. Column of value to return. Indexed from 0. + * @param int $y Optional. Row of value to return. Indexed from 0. * @return string|null Database query result (as string), or null on failure */ public function get_var( $query = null, $x = 0, $y = 0 ) { $this->func_call = "\$db->get_var(\"$query\", $x, $y)"; - if ( $this->check_safe_collation( $query ) ) { + if ( $this->check_current_query && $this->check_safe_collation( $query ) ) { $this->check_current_query = false; } @@ -2052,16 +2136,18 @@ class wpdb { * * @since 0.71 * - * @param string|null $query SQL query. - * @param string $output Optional. one of ARRAY_A | ARRAY_N | OBJECT constants. Return an associative array (column => value, ...), - * a numerically indexed array (0 => value, ...) or an object ( ->column = value ), respectively. - * @param int $y Optional. Row to return. Indexed from 0. - * @return mixed Database query result in format specified by $output or null on failure + * @param string|null $query SQL query. + * @param string $output Optional. one of ARRAY_A | ARRAY_N | OBJECT constants. + * Return an associative array (column => value, ...), + * a numerically indexed array (0 => value, ...) or + * an object ( ->column = value ), respectively. + * @param int $y Optional. Row to return. Indexed from 0. + * @return array|object|null|void Database query result in format specified by $output or null on failure */ public function get_row( $query = null, $output = OBJECT, $y = 0 ) { $this->func_call = "\$db->get_row(\"$query\",$output,$y)"; - if ( $this->check_safe_collation( $query ) ) { + if ( $this->check_current_query && $this->check_safe_collation( $query ) ) { $this->check_current_query = false; } @@ -2098,11 +2184,11 @@ class wpdb { * @since 0.71 * * @param string|null $query Optional. SQL query. Defaults to previous query. - * @param int $x Optional. Column to return. Indexed from 0. + * @param int $x Optional. Column to return. Indexed from 0. * @return array Database query result. Array indexed from 0 by SQL result row number. */ public function get_col( $query = null , $x = 0 ) { - if ( $this->check_safe_collation( $query ) ) { + if ( $this->check_current_query && $this->check_safe_collation( $query ) ) { $this->check_current_query = false; } @@ -2125,16 +2211,18 @@ class wpdb { * * @since 0.71 * - * @param string $query SQL query. - * @param string $output Optional. Any of ARRAY_A | ARRAY_N | OBJECT | OBJECT_K constants. With one of the first three, return an array of rows indexed from 0 by SQL result row number. - * Each row is an associative array (column => value, ...), a numerically indexed array (0 => value, ...), or an object. ( ->column = value ), respectively. - * With OBJECT_K, return an associative array of row objects keyed by the value of each row's first column's value. Duplicate keys are discarded. - * @return mixed Database query results + * @param string $query SQL query. + * @param string $output Optional. Any of ARRAY_A | ARRAY_N | OBJECT | OBJECT_K constants. + * With one of the first three, return an array of rows indexed from 0 by SQL result row number. + * Each row is an associative array (column => value, ...), a numerically indexed array (0 => value, ...), or an object. ( ->column = value ), respectively. + * With OBJECT_K, return an associative array of row objects keyed by the value of each row's first column's value. + * Duplicate keys are discarded. + * @return array|object|null Database query results */ public function get_results( $query = null, $output = OBJECT ) { $this->func_call = "\$db->get_results(\"$query\", $output)"; - if ( $this->check_safe_collation( $query ) ) { + if ( $this->check_current_query && $this->check_safe_collation( $query ) ) { $this->check_current_query = false; } @@ -2186,7 +2274,7 @@ class wpdb { * @access protected * * @param string $table Table name. - * @return string|WP_Error Table character set, {@see WP_Error} object if it couldn't be found. + * @return string|WP_Error Table character set, WP_Error object if it couldn't be found. */ protected function get_table_charset( $table ) { $tablekey = strtolower( $table ); @@ -2212,7 +2300,10 @@ class wpdb { } $charsets = $columns = array(); - $results = $this->get_results( "SHOW FULL COLUMNS FROM `$table`" ); + + $table_parts = explode( '.', $table ); + $table = '`' . implode( '`.`', $table_parts ) . '`'; + $results = $this->get_results( "SHOW FULL COLUMNS FROM $table" ); if ( ! $results ) { return new WP_Error( 'wpdb_get_table_charset_failure' ); } @@ -2226,6 +2317,12 @@ class wpdb { foreach ( $columns as $column ) { if ( ! empty( $column->Collation ) ) { list( $charset ) = explode( '_', $column->Collation ); + + // If the current connection can't support utf8mb4 characters, let's only send 3-byte utf8 characters. + if ( 'utf8mb4' === $charset && ! $this->has_cap( 'utf8mb4' ) ) { + $charset = 'utf8'; + } + $charsets[ strtolower( $charset ) ] = true; } @@ -2279,8 +2376,8 @@ class wpdb { * * @param string $table Table name. * @param string $column Column name. - * @return mixed Column character set as a string. False if the column has no - * character set. {@see WP_Error} object if there was an error. + * @return string|false|WP_Error Column character set as a string. False if the column has no + * character set. WP_Error object if there was an error. */ public function get_col_charset( $table, $column ) { $tablekey = strtolower( $table ); @@ -2335,6 +2432,99 @@ class wpdb { return $charset; } + /** + * Retrieve the maximum string length allowed in a given column. + * The length may either be specified as a byte length or a character length. + * + * @since 4.2.1 + * @access public + * + * @param string $table Table name. + * @param string $column Column name. + * @return array|false|WP_Error array( 'length' => (int), 'type' => 'byte' | 'char' ) + * false if the column has no length (for example, numeric column) + * WP_Error object if there was an error. + */ + public function get_col_length( $table, $column ) { + $tablekey = strtolower( $table ); + $columnkey = strtolower( $column ); + + // Skip this entirely if this isn't a MySQL database. + if ( false === $this->is_mysql ) { + return false; + } + + if ( empty( $this->col_meta[ $tablekey ] ) ) { + // This primes column information for us. + $table_charset = $this->get_table_charset( $table ); + if ( is_wp_error( $table_charset ) ) { + return $table_charset; + } + } + + if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) { + return false; + } + + $typeinfo = explode( '(', $this->col_meta[ $tablekey ][ $columnkey ]->Type ); + + $type = strtolower( $typeinfo[0] ); + if ( ! empty( $typeinfo[1] ) ) { + $length = trim( $typeinfo[1], ')' ); + } else { + $length = false; + } + + switch( $type ) { + case 'char': + case 'varchar': + return array( + 'type' => 'char', + 'length' => (int) $length, + ); + break; + case 'binary': + case 'varbinary': + return array( + 'type' => 'byte', + 'length' => (int) $length, + ); + break; + case 'tinyblob': + case 'tinytext': + return array( + 'type' => 'byte', + 'length' => 255, // 2^8 - 1 + ); + break; + case 'blob': + case 'text': + return array( + 'type' => 'byte', + 'length' => 65535, // 2^16 - 1 + ); + break; + case 'mediumblob': + case 'mediumtext': + return array( + 'type' => 'byte', + 'length' => 16777215, // 2^24 - 1 + ); + break; + case 'longblob': + case 'longtext': + return array( + 'type' => 'byte', + 'length' => 4294967295, // 2^32 - 1 + ); + break; + default: + return false; + } + + return false; + } + /** * Check if a string is ASCII. * @@ -2375,7 +2565,7 @@ class wpdb { // We don't need to check the collation for queries that don't read data. $query = ltrim( $query, "\r\n\t (" ); - if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN)\s/i', $query ) ) { + if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $query ) ) { return true; } @@ -2429,54 +2619,61 @@ class wpdb { * @return array|WP_Error The $data parameter, with invalid characters removed from * each value. This works as a passthrough: any additional keys * such as 'field' are retained in each value array. If we cannot - * remove invalid characters, a {@see WP_Error} object is returned. + * remove invalid characters, a WP_Error object is returned. */ - // If any of the columns don't have one of these collations, it needs more sanity checking. protected function strip_invalid_text( $data ) { - // Some multibyte character sets that we can check in PHP. - $mb_charsets = array( - 'ascii' => 'ASCII', - 'big5' => 'BIG-5', - 'eucjpms' => 'eucJP-win', - 'gb2312' => 'EUC-CN', - 'ujis' => 'EUC-JP', - 'utf32' => 'UTF-32', - ); - - $supported_charsets = array(); - if ( function_exists( 'mb_list_encodings' ) ) { - $supported_charsets = mb_list_encodings(); - } - $db_check_string = false; foreach ( $data as &$value ) { $charset = $value['charset']; - // Column isn't a string, or is latin1, which will will happily store anything. - if ( false === $charset || 'latin1' === $charset ) { + if ( is_array( $value['length'] ) ) { + $length = $value['length']['length']; + $truncate_by_byte_length = 'byte' === $value['length']['type']; + } else { + $length = false; + // Since we have no length, we'll never truncate. + // Initialize the variable to false. true would take us + // through an unnecessary (for this case) codepath below. + $truncate_by_byte_length = false; + } + + // There's no charset to work with. + if ( false === $charset ) { continue; } + // Column isn't a string. if ( ! is_string( $value['value'] ) ) { continue; } - // ASCII is always OK. - if ( ! isset( $value['ascii'] ) && $this->check_ascii( $value['value'] ) ) { - continue; + $needs_validation = true; + if ( + // latin1 can store any byte sequence + 'latin1' === $charset + || + // ASCII is always OK. + ( ! isset( $value['ascii'] ) && $this->check_ascii( $value['value'] ) ) + ) { + $truncate_by_byte_length = true; + $needs_validation = false; } - // Convert the text locally. - if ( $supported_charsets ) { - if ( isset( $mb_charsets[ $charset ] ) && in_array( $mb_charsets[ $charset ], $supported_charsets ) ) { - $value['value'] = mb_convert_encoding( $value['value'], $mb_charsets[ $charset ], $mb_charsets[ $charset ] ); + if ( $truncate_by_byte_length ) { + mbstring_binary_safe_encoding(); + if ( false !== $length && strlen( $value['value'] ) > $length ) { + $value['value'] = substr( $value['value'], 0, $length ); + } + reset_mbstring_encoding(); + + if ( ! $needs_validation ) { continue; } } // utf8 can be handled by regex, which is a bunch faster than a DB lookup. - if ( 'utf8' === $charset || 'utf8mb3' === $charset || 'utf8mb4' === $charset ) { + if ( ( 'utf8' === $charset || 'utf8mb3' === $charset || 'utf8mb4' === $charset ) && function_exists( 'mb_strlen' ) ) { $regex = '/ ( (?: [\x00-\x7F] # single-byte sequences 0xxxxxxx @@ -2486,7 +2683,7 @@ class wpdb { | \xED[\x80-\x9F][\x80-\xBF] | [\xEE-\xEF][\x80-\xBF]{2}'; - if ( 'utf8mb4' === $charset) { + if ( 'utf8mb4' === $charset ) { $regex .= ' | \xF0[\x90-\xBF][\x80-\xBF]{2} # four-byte sequences 11110xxx 10xxxxxx * 3 | [\xF1-\xF3][\x80-\xBF]{3} @@ -2494,11 +2691,16 @@ class wpdb { '; } - $regex .= '){1,50} # ...one or more times + $regex .= '){1,40} # ...one or more times ) | . # anything else /x'; $value['value'] = preg_replace( $regex, '$1', $value['value'] ); + + + if ( false !== $length && mb_strlen( $value['value'], 'UTF-8' ) > $length ) { + $value['value'] = mb_substr( $value['value'], 0, $length, 'UTF-8' ); + } continue; } @@ -2511,46 +2713,44 @@ class wpdb { $queries = array(); foreach ( $data as $col => $value ) { if ( ! empty( $value['db'] ) ) { - if ( ! isset( $queries[ $value['charset'] ] ) ) { - $queries[ $value['charset'] ] = array(); + // We're going to need to truncate by characters or bytes, depending on the length value we have. + if ( 'byte' === $value['length']['type'] ) { + // Using binary causes LEFT() to truncate by bytes. + $charset = 'binary'; + } else { + $charset = $value['charset']; + } + + if ( is_array( $value['length'] ) ) { + $queries[ $col ] = $this->prepare( "CONVERT( LEFT( CONVERT( %s USING $charset ), %.0f ) USING {$this->charset} )", $value['value'], $value['length']['length'] ); + } else if ( 'binary' !== $charset ) { + // If we don't have a length, there's no need to convert binary - it will always return the same result. + $queries[ $col ] = $this->prepare( "CONVERT( CONVERT( %s USING $charset ) USING {$this->charset} )", $value['value'] ); } - // Split the CONVERT() calls by charset, so we can make sure the connection is right - $queries[ $value['charset'] ][ $col ] = $this->prepare( "CONVERT( %s USING {$value['charset']} )", $value['value'] ); unset( $data[ $col ]['db'] ); } } - $connection_charset = $this->charset; - foreach ( $queries as $charset => $query ) { + $sql = array(); + foreach ( $queries as $column => $query ) { if ( ! $query ) { continue; } - // Change the charset to match the string(s) we're converting - if ( $charset !== $connection_charset ) { - $connection_charset = $charset; - $this->set_charset( $this->dbh, $charset ); - } - - $this->check_current_query = false; - - $row = $this->get_row( "SELECT " . implode( ', ', $query ), ARRAY_N ); - if ( ! $row ) { - $this->set_charset( $this->dbh, $connection_charset ); - return new WP_Error( 'wpdb_strip_invalid_text_failure' ); - } + $sql[] = $query . " AS x_$column"; + } - $cols = array_keys( $query ); - $col_count = count( $cols ); - for ( $ii = 0; $ii < $col_count; $ii++ ) { - $data[ $cols[ $ii ] ]['value'] = $row[ $ii ]; - } + $this->check_current_query = false; + $row = $this->get_row( "SELECT " . implode( ', ', $sql ), ARRAY_A ); + if ( ! $row ) { + return new WP_Error( 'wpdb_strip_invalid_text_failure' ); } - // Don't forget to change the charset back! - if ( $connection_charset !== $this->charset ) { - $this->set_charset( $this->dbh ); + foreach ( array_keys( $data ) as $column ) { + if ( isset( $row["x_$column"] ) ) { + $data[ $column ]['value'] = $row["x_$column"]; + } } } @@ -2564,9 +2764,15 @@ class wpdb { * @access protected * * @param string $query Query to convert. - * @return string|WP_Error The converted query, or a {@see WP_Error} object if the conversion fails. + * @return string|WP_Error The converted query, or a WP_Error object if the conversion fails. */ protected function strip_invalid_text_from_query( $query ) { + // We don't need to check the collation for queries that don't read data. + $trimmed_query = ltrim( $query, "\r\n\t (" ); + if ( preg_match( '/^(?:SHOW|DESCRIBE|DESC|EXPLAIN|CREATE)\s/i', $trimmed_query ) ) { + return $query; + } + $table = $this->get_table_from_query( $query ); if ( $table ) { $charset = $this->get_table_charset( $table ); @@ -2586,6 +2792,7 @@ class wpdb { 'value' => $query, 'charset' => $charset, 'ascii' => false, + 'length' => false, ); $data = $this->strip_invalid_text( array( $data ) ); @@ -2605,10 +2812,10 @@ class wpdb { * @param string $table Table name. * @param string $column Column name. * @param string $value The text to check. - * @return string|WP_Error The converted string, or a `WP_Error` object if the conversion fails. + * @return string|WP_Error The converted string, or a WP_Error object if the conversion fails. */ public function strip_invalid_text_for_column( $table, $column, $value ) { - if ( ! is_string( $value ) || $this->check_ascii( $value ) ) { + if ( ! is_string( $value ) ) { return $value; } @@ -2625,7 +2832,7 @@ class wpdb { $column => array( 'value' => $value, 'charset' => $charset, - 'ascii' => false, + 'length' => $this->get_col_length( $table, $column ), ) ); @@ -2653,11 +2860,8 @@ class wpdb { // Allow (select...) union [...] style queries. Use the first query's table name. $query = ltrim( $query, "\r\n\t (" ); - /* - * Strip everything between parentheses except nested selects and use only 1,000 - * chars of the query. - */ - $query = preg_replace( '/\((?!\s*select)[^(]*?\)/is', '()', substr( $query, 0, 1000 ) ); + // Strip everything between parentheses except nested selects. + $query = preg_replace( '/\((?!\s*select)[^(]*?\)/is', '()', $query ); // Quickly match most common queries. if ( preg_match( '/^\s*(?:' @@ -2666,16 +2870,16 @@ class wpdb { . '|REPLACE(?:\s+LOW_PRIORITY|\s+DELAYED)?(?:\s+INTO)?' . '|UPDATE(?:\s+LOW_PRIORITY)?(?:\s+IGNORE)?' . '|DELETE(?:\s+LOW_PRIORITY|\s+QUICK|\s+IGNORE)*(?:\s+FROM)?' - . ')\s+`?([\w-]+)`?/is', $query, $maybe ) ) { - return $maybe[1]; + . ')\s+((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)/is', $query, $maybe ) ) { + return str_replace( '`', '', $maybe[1] ); } // SHOW TABLE STATUS and SHOW TABLES if ( preg_match( '/^\s*(?:' . 'SHOW\s+TABLE\s+STATUS.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)' . '|SHOW\s+(?:FULL\s+)?TABLES.+(?:LIKE\s+|WHERE\s+Name\s*=\s*)' - . ')\W([\w-]+)\W/is', $query, $maybe ) ) { - return $maybe[1]; + . ')\W((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)\W/is', $query, $maybe ) ) { + return str_replace( '`', '', $maybe[1] ); } // Big pattern for the rest of the table-related queries. @@ -2693,8 +2897,8 @@ class wpdb { . '|LOAD\s+DATA.*INFILE.*INTO\s+TABLE' . '|(?:GRANT|REVOKE).*ON\s+TABLE' . '|SHOW\s+(?:.*FROM|.*TABLE)' - . ')\s+\(*\s*`?([\w-]+)`?\s*\)*/is', $query, $maybe ) ) { - return $maybe[1]; + . ')\s+\(*\s*((?:[0-9a-zA-Z$_.`-]|[\xC2-\xDF][\x80-\xBF])+)\s*\)*/is', $query, $maybe ) ) { + return str_replace( '`', '', $maybe[1] ); } return false; @@ -2712,11 +2916,13 @@ class wpdb { return; if ( $this->use_mysqli ) { - for ( $i = 0; $i < @mysqli_num_fields( $this->result ); $i++ ) { + $num_fields = @mysqli_num_fields( $this->result ); + for ( $i = 0; $i < $num_fields; $i++ ) { $this->col_info[ $i ] = @mysqli_fetch_field( $this->result ); } } else { - for ( $i = 0; $i < @mysql_num_fields( $this->result ); $i++ ) { + $num_fields = @mysql_num_fields( $this->result ); + for ( $i = 0; $i < $num_fields; $i++ ) { $this->col_info[ $i ] = @mysql_fetch_field( $this->result, $i ); } } @@ -2727,8 +2933,8 @@ class wpdb { * * @since 0.71 * - * @param string $info_type Optional. Type one of name, table, def, max_length, not_null, primary_key, multiple_key, unique_key, numeric, blob, type, unsigned, zerofill - * @param int $col_offset Optional. 0: col name. 1: which table the col's in. 2: col's max length. 3: if the col is numeric. 4: col's type + * @param string $info_type Optional. Type one of name, table, def, max_length, not_null, primary_key, multiple_key, unique_key, numeric, blob, type, unsigned, zerofill + * @param int $col_offset Optional. 0: col name. 1: which table the col's in. 2: col's max length. 3: if the col is numeric. 4: col's type * @return mixed Column Results */ public function get_col_info( $info_type = 'name', $col_offset = -1 ) { @@ -2754,7 +2960,7 @@ class wpdb { * * @since 1.5.0 * - * @return bool + * @return true */ public function timer_start() { $this->time_start = microtime( true ); @@ -2779,7 +2985,7 @@ class wpdb { * * @since 1.5.0 * - * @param string $message The Error message + * @param string $message The Error message * @param string $error_code Optional. A Computer readable string to identify the error. * @return false|void */ @@ -2798,10 +3004,11 @@ class wpdb { * Whether MySQL database is at least the required minimum version. * * @since 2.5.0 - * @uses $wp_version - * @uses $required_mysql_version * - * @return WP_Error + * @global string $wp_version + * @global string $required_mysql_version + * + * @return WP_Error|void */ public function check_database_version() { global $wp_version, $required_mysql_version; @@ -2855,7 +3062,7 @@ class wpdb { * @param string $db_cap The feature to check for. Accepts 'collation', * 'group_concat', 'subqueries', 'set_charset', * or 'utf8mb4'. - * @return bool Whether the database feature is supported, false otherwise. + * @return int|false Whether the database feature is supported, false otherwise. */ public function has_cap( $db_cap ) { $version = $this->db_version(); @@ -2868,7 +3075,25 @@ class wpdb { case 'set_charset' : return version_compare( $version, '5.0.7', '>=' ); case 'utf8mb4' : // @since 4.1.0 - return version_compare( $version, '5.5.3', '>=' ); + if ( version_compare( $version, '5.5.3', '<' ) ) { + return false; + } + if ( $this->use_mysqli ) { + $client_version = mysqli_get_client_info(); + } else { + $client_version = mysql_get_client_info(); + } + + /* + * libmysql has supported utf8mb4 since 5.5.3, same as the MySQL server. + * mysqlnd has supported utf8mb4 since 5.0.9. + */ + if ( false !== strpos( $client_version, 'mysqlnd' ) ) { + $client_version = preg_replace( '/^\D+([\d.]+).*/', '$1', $client_version ); + return version_compare( $client_version, '5.0.9', '>=' ); + } else { + return version_compare( $client_version, '5.5.3', '>=' ); + } } return false; @@ -2882,7 +3107,7 @@ class wpdb { * * @since 2.5.0 * - * @return string The name of the calling function + * @return string|array The name of the calling function */ public function get_caller() { return wp_debug_backtrace_summary( __CLASS__ );