Incorrect use of wpdb::prepare on delete actions about glotpress

[toolstack]

I'd vote for skipping it if the number of args is only 1.

[toolstack]

Actually digging in to the code some more this should already be handled correctly, from thing.php:

    function prepare( $args ) {
        global $wpdb;
        if ( 1 == count( $args ) ) {
            return $args[0];
        } else {
            $query = array_shift( $args );
            return $wpdb->prepare( $query, $args );
        }
    }

Where are you trying to delete the glossary/project from? I don't see any UI for it...

[toolstack]

Ok, I found the issue:

    function delete_all( $where = null  ) {
        $query = "DELETE FROM $this->table";
        $conditions_sql = $this->sql_from_conditions( $where );
        if ( $conditions_sql ) $query .= " WHERE $conditions_sql";
        return $this->query( $query, $this->id );
    }

Notice the call to $this->query always adds in $this->id, which forces the args count to be 2 even if the query returned does not require it.

Backpress (I assume) like older versions of WordPress (pre 3.5?) didn't throw an error if you passed in a string without any placeholders to prepare() so it wasn't a problem in standalone.

The "off the top of my head" solution is to replace the above with:

    function delete_all( $where = null  ) {
        $query = "DELETE FROM $this->table";
        $conditions_sql = $this->sql_from_conditions( $where );
        if ( $conditions_sql ) $query .= " WHERE $conditions_sql";

        // If there are placeholders in the query, pass in the id otherwise don't because $wpdb->prepare will throw an error.
        if ( preg_match( '/\%[sdf]/i', $query ) ) {
            return $this->query( $query, $this->id );
        } else {
            return $this->query( $query );
        }
    }

but that's kind of ugly 😦

Though since it won't be called all that often it may be reasonable.

[toolstack]

I've poked at this some more and I think there's an easier solution than the above, which is just to remove $this->id from the query call. None of the delete methods use it as far as I can tell.

I'll create a PR for it.

[ocean90]

@toolstack Looks like you're right, seems to be a copy&paste issue in https://glotpress.trac.wordpress.org/changeset/500.

[toolstack]

Woohoo! I like it when I'm right 😄