wp-includes/wp-db.php
/**
	 * Prepares a SQL query for safe execution. Uses sprintf()-like syntax.
	 *
	 * The following placeholders can be used in the query string:
	 *   %d (integer)
	 *   %f (float)
	 *   %s (string)
	 *
	 * All placeholders MUST be left unquoted in the query string. A corresponding argument MUST be passed for each placeholder.
	 *
	 * For compatibility with old behavior, numbered or formatted string placeholders (eg, %1$s, %5s) will not have quotes
	 * added by this function, so should be passed with appropriate quotes around them for your usage.
	 *
	 * Literal percentage signs (%) in the query string must be written as %%. Percentage wildcards (for example,
	 * to use in LIKE syntax) must be passed via a substitution argument containing the complete LIKE string, these
	 * cannot be inserted directly in the query string. Also see {@see esc_like()}.
	 *
	 * Arguments may be passed as individual arguments to the method, or as a single array containing all arguments. A combination
	 * of the two is not supported.
	 *
	 * Examples:
	 *     $wpdb->prepare( "SELECT * FROM `table` WHERE `column` = %s AND `field` = %d OR `other_field` LIKE %s", array( 'foo', 1337, '%bar' ) );
	 *     $wpdb->prepare( "SELECT DATE_FORMAT(`field`, '%%c') FROM `table` WHERE `column` = %s", 'foo' );
	 *
	 * @link https://secure.php.net/sprintf Description of syntax.
	 * @since 2.3.0
	 *
	 * @param string      $query    Query statement with sprintf()-like placeholders
	 * @param array|mixed $args     The array of variables to substitute into the query's placeholders if being called with an array of arguments,
	 *                              or the first variable to substitute into the query's placeholders if being called with individual arguments.
	 * @param mixed       $args,... further variables to substitute into the query's placeholders if being called wih individual arguments.
	 * @return string|void Sanitized query string, if there is a query to prepare.
	 */
Prepares a SQL query for safe execution. Uses sprintf()-like syntax.
The following placeholders can be used in the query string:
%d (integer)
%f (float)
%s (string)

All placeholders MUST be left unquoted in the query string. A corresponding argument MUST be passed for each placeholder.

For compatibility with old behavior, numbered or formatted string placeholders  will not have quotes
added by this function, so should be passed with appropriate quotes around them for your usage.

Literal percentage signs (%) in the query string must be written as %%. Percentage wildcards (for example,
to use in LIKE syntax) must be passed via a substitution argument containing the complete LIKE string, these
cannot be inserted directly in the query string.

Arguments may be passed as individual arguments to the method, or as a single array containing all arguments. A combination
of the two is not supported.





@param string      $query    Query statement with sprintf()-like placeholders
@param array|mixed $args     The array of variables to substitute into the query's placeholders if being called with an array of arguments,
or the first variable to substitute into the query's placeholders if being called with individual arguments.
@param mixed       $args,... further variables to substitute into the query's placeholders if being called wih individual arguments.
@return string|void Sanitized query string, if there is a query to prepare.
Prepares a SQL query for safe execution . Uses sprintf () - like syntax . The following placeholders can be used in the query string : %d ( integer ) %f ( float ) %s ( string ) All placeholders MUST be left unquoted in the query string . A corresponding argument MUST be passed for each placeholder . For compatibility with old behavior numbered or formatted string placeholders will not have quotes added by this function so should be passed with appropriate quotes around them for your usage . Literal percentage signs ( % ) in the query string must be written as %% . Percentage wildcards ( for example to use in LIKE syntax ) must be passed via a substitution argument containing the complete LIKE string these cannot be inserted directly in the query string . Arguments may be passed as individual arguments to the method or as a single array containing all arguments . A combination of the two is not supported . @param string $query Query statement with sprintf () - like placeholders @param array|mixed $args The array of variables to substitute into the query ' s placeholders if being called with an array of arguments or the first variable to substitute into the query ' s placeholders if being called with individual arguments . @param mixed $args ... further variables to substitute into the query ' s placeholders if being called wih individual arguments . @return string|void Sanitized query string if there is a query to prepare .
public function prepare( $query, $args ) {
		if ( is_null( $query ) ) {
			return;
		}
		if ( strpos( $query, '%' ) === false ) {
			wp_load_translations_early();
			_doing_it_wrong( 'wpdb::prepare', sprintf( __( 'The query argument of %s must have a placeholder.' ), 'wpdb::prepare()' ), '3.9.0' );
		}
		$args = func_get_args();
		array_shift( $args );
		$passed_as_array = false;
		if ( is_array( $args[0] ) && count( $args ) == 1 ) {
			$passed_as_array = true;
			$args = $args[0];
		}
		foreach ( $args as $arg ) {
			if ( ! is_scalar( $arg ) && ! is_null( $arg ) ) {
				wp_load_translations_early();
				_doing_it_wrong( 'wpdb::prepare', sprintf( __( 'Unsupported value type (%s).' ), gettype( $arg ) ), '4.8.2' );
			}
		}
		$allowed_format = '(?:[1-9][0-9]*[$])?[-+0-9]*(?: |0|\'.)?[-+0-9]*(?:\.[0-9]+)?';
		$query = str_replace( "'%s'", '%s', $query ); 
		$query = str_replace( '"%s"', '%s', $query ); 
		$query = preg_replace( '/(?<!%)%s/', "'%s'", $query ); 
		$query = preg_replace( "/(?<!%)(%($allowed_format)?f)/" , '%\\2F', $query ); 
		$query = preg_replace( "/%(?:%|$|(?!($allowed_format)?[sdF]))/", '%%\\1', $query ); 
		$placeholders = preg_match_all( "/(^|[^%]|(%%)+)%($allowed_format)?[sdF]/", $query, $matches );
		if ( count( $args ) !== $placeholders ) {
			if ( 1 === $placeholders && $passed_as_array ) {
				wp_load_translations_early();
				_doing_it_wrong( 'wpdb::prepare', __( 'The query only expected one placeholder, but an array of multiple placeholders was sent.' ), '4.9.0' );
				return;
			} else {
				wp_load_translations_early();
				_doing_it_wrong( 'wpdb::prepare',
					sprintf( __( 'The query does not contain the correct number of placeholders (%1$d) for the number of arguments passed (%2$d).' ),
						$placeholders,
						count( $args ) ),
					'4.8.3'
				);
			}
		}
		array_walk( $args, array( $this, 'escape_by_ref' ) );
		$query = @vsprintf( $query, $args );
		return $this->add_placeholder_escape( $query );
	}
public function prepare ( $ query , $ args ) { if ( is_null ( $ query ) ) { return ; } if ( strpos ( $ query , '%' ) === false ) { wp_load_translations_early ( ) ; _doing_it_wrong ( 'wpdb::prepare' , sprintf ( __ ( 'The query argument of %s must have a placeholder.' ) , 'wpdb::prepare()' ) , '3.9.0' ) ; } $ args = func_get_args ( ) ; array_shift ( $ args ) ; $ passed_as_array = false ; if ( is_array ( $ args [ 0 ] ) && count ( $ args ) == 1 ) { $ passed_as_array = true ; $ args = $ args [ 0 ] ; } foreach ( $ args as $ arg ) { if ( ! is_scalar ( $ arg ) && ! is_null ( $ arg ) ) { wp_load_translations_early ( ) ; _doing_it_wrong ( 'wpdb::prepare' , sprintf ( __ ( 'Unsupported value type (%s).' ) , gettype ( $ arg ) ) , '4.8.2' ) ; } } $ allowed_format = '(?:[1-9][0-9]*[$])?[-+0-9]*(?: |0|\'.)?[-+0-9]*(?:\.[0-9]+)?' ; $ query = str_replace ( " '%s' " , '%s' , $ query ) ; $ query = str_replace ( '"%s"' , '%s' , $ query ) ; $ query = preg_replace ( '/(?<!%)%s/' , " '%s' " , $ query ) ; $ query = preg_replace ( " /(?<!%)(%( $ allowed_format )?f)/ " , '%\\2F' , $ query ) ; $ query = preg_replace ( " /%(?:%|$|(?!( $ allowed_format )?[sdF]))/ " , '%%\\1' , $ query ) ; $ placeholders = preg_match_all ( " /(^|[^%]|(%%)+)%( $ allowed_format )?[sdF]/ " , $ query , $ matches ) ; if ( count ( $ args ) !== $ placeholders ) { if ( 1 === $ placeholders && $ passed_as_array ) { wp_load_translations_early ( ) ; _doing_it_wrong ( 'wpdb::prepare' , __ ( 'The query only expected one placeholder, but an array of multiple placeholders was sent.' ) , '4.9.0' ) ; return ; } else { wp_load_translations_early ( ) ; _doing_it_wrong ( 'wpdb::prepare' , sprintf ( __ ( 'The query does not contain the correct number of placeholders (%1$d) for the number of arguments passed (%2$d).' ) , $ placeholders , count ( $ args ) ) , '4.8.3' ) ; } } array_walk ( $ args , array ( $ this , 'escape_by_ref' ) ) ; $ query = @ vsprintf ( $ query , $ args ) ; return $ this -> add_placeholder_escape ( $ query ) ; }
Prepares a SQL query for safe execution.
Prepares a SQL query for safe execution .
// This is not meant to be foolproof -- but it will catch obviously incorrect usage. // If args were passed as an array (as in vsprintf), move them up. /*
		 * Specify the formatting allowed in a placeholder. The following are allowed:
		 *
		 * - Sign specifier. eg, $+d
		 * - Numbered placeholders. eg, %1$s
		 * - Padding specifier, including custom padding characters. eg, %05s, %'#5s
		 * - Alignment specifier. eg, %05-s
		 * - Precision specifier. eg, %.2f
		 */ /*
		 * If a %s placeholder already has quotes around it, removing the existing quotes and re-inserting them
		 * ensures the quotes are consistent.
		 *
		 * For backwards compatibility, this is only applied to %s, and not to placeholders like %1$s, which are frequently
		 * used in the middle of longer strings, or as table name placeholders.
		 */ // Strip any existing single quotes. // Strip any existing double quotes. // Quote the strings, avoiding escaped strings like %%s. // Force floats to be locale unaware. // Escape any unescaped percents. // Count the number of valid placeholders in the query. // If the passed query only expected one argument, but the wrong number of arguments were sent as an array, bail. /*
				 * If we don't have the right number of placeholders, but they were passed as individual arguments,
				 * or we were expecting multiple arguments in an array, throw a warning.
				 */ /* translators: 1: number of placeholders, 2: number of arguments passed */