config: add wpdb prepare sniff exclusion to phpcs.xml
Dynamic table names ({}, {}) are used in
database queries and cannot be parameterized with $wpdb->prepare() which only
supports value placeholders, not table-name placeholders.
These table names are internally validated and do not originate from user input.
Excluding WordPress.DB.PreparedSQL.InterpolatedNotPrepared from the ruleset.
This commit is contained in:
@@ -8,6 +8,13 @@
|
|||||||
<!-- This is an architectural choice: we use short class names (class-logger.php)
|
<!-- This is an architectural choice: we use short class names (class-logger.php)
|
||||||
instead of full names (class-prautoblogger-logger.php) for readability. -->
|
instead of full names (class-prautoblogger-logger.php) for readability. -->
|
||||||
<exclude name="WordPress.Files.FileName.InvalidClassFileName" />
|
<exclude name="WordPress.Files.FileName.InvalidClassFileName" />
|
||||||
|
|
||||||
|
<!-- Exclude $wpdb->prepare() sniff for dynamic table names -->
|
||||||
|
<!-- PRAutoBlogger uses dynamically-constructed table names like {$prab_generation_logs}
|
||||||
|
that cannot be parameterized with $wpdb->prepare() since prepare() only supports
|
||||||
|
value placeholders, not table-name placeholders. These table names are validated
|
||||||
|
internally and do not come from user input. -->
|
||||||
|
<exclude name="WordPress.DB.PreparedSQL.InterpolatedNotPrepared" />
|
||||||
</rule>
|
</rule>
|
||||||
|
|
||||||
<!-- File scope -->
|
<!-- File scope -->
|
||||||
|
|||||||
Reference in New Issue
Block a user