Skip to content

Security Fix: Update in_clause to use QueryHelper and prepare statements #2443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shewa12 merged 2 commits into from
Mar 30, 2026
Merged

Security Fix: Update in_clause to use QueryHelper and prepare statements #2443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1cfef42
Refactor database queries to use prepared statements for improved sec…
Anindra123 Mar 13, 2026
0d201a8
updated in_clause to use query helper
Anindra123 Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions classes/QuizBuilder.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,16 +301,16 @@ public function handle_delete( $deleted_question_ids = array(), $deleted_answer_
$deleted_answer_ids = array_filter( $deleted_answer_ids, 'is_numeric' );

if ( count( $deleted_question_ids ) ) {
$id_str = QueryHelper::prepare_in_clause( $deleted_question_ids );
//phpcs:ignore -- sanitized $id_str.
$wpdb->query( "DELETE FROM {$wpdb->prefix}tutor_quiz_questions WHERE content_id IS NULL AND question_id IN (" . $id_str . ')' );
$in_clause = QueryHelper::prepare_in_clause( $deleted_question_ids );
//phpcs:ignore -- sanitized $in_clause.
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}tutor_quiz_questions WHERE content_id IS NULL AND question_id IN ({$in_clause})" ) );
do_action( 'tutor_deleted_quiz_question_ids', $deleted_question_ids );
}

if ( count( $deleted_answer_ids ) ) {
$id_str = QueryHelper::prepare_in_clause( $deleted_answer_ids );
//phpcs:ignore -- sanitized $id_str.
$wpdb->query( "DELETE FROM {$wpdb->prefix}tutor_quiz_question_answers WHERE answer_id IN (" . $id_str . ')' );
$in_clause = QueryHelper::prepare_in_clause( $deleted_answer_ids );
//phpcs:ignore -- sanitized $in_clause.
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}tutor_quiz_question_answers WHERE answer_id IN ({$in_clause})" ) );
}
}

Expand Down Expand Up @@ -430,6 +430,5 @@ public function ajax_quiz_builder_save() {
} else {
$this->json_response( __( 'Error', 'tutor' ), $result->errors, HttpHelper::STATUS_BAD_REQUEST );
}

}
}
11 changes: 6 additions & 5 deletions classes/Tutor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@

use Tutor\Models\CourseModel;
use Tutor\Ecommerce\Ecommerce;
use Tutor\Helpers\QueryHelper;
use Tutor\Migrations\Migration;
use Tutor\TemplateImport\TemplateImportInit;

Expand Down Expand Up @@ -1131,7 +1132,7 @@
/**
* Add Instructor role to administrator
*/
if ( current_user_can( 'administrator' ) ) {

Check failure on line 1135 in classes/Tutor.php

View workflow job for this annotation

GitHub Actions / WPCS 

Capabilities should be used instead of roles. Found "administrator" in function call to current_user_can()
tutor_utils()->add_instructor_role( get_current_user_id() );
}
}
Expand Down Expand Up @@ -1359,8 +1360,8 @@
'tutor_announcements',
);

$post_type_strings = "'" . implode( "','", $post_types ) . "'";
$tutor_posts = $wpdb->get_col( "SELECT ID from {$wpdb->posts} WHERE post_type in({$post_type_strings}) ;" ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$in_clause = QueryHelper::prepare_in_clause( $post_types );
$tutor_posts = $wpdb->get_col( $wpdb->prepare( "SELECT ID from {$wpdb->posts} WHERE post_type IN({$in_clause}) ;" ) ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared

if ( is_array( $tutor_posts ) && count( $tutor_posts ) ) {
foreach ( $tutor_posts as $post_id ) {
Expand All @@ -1385,10 +1386,10 @@
/**
* Deleting Comments (reviews, questions, quiz_answers, etc)
*/
$tutor_comments = $wpdb->get_col( "SELECT comment_ID from {$wpdb->comments} WHERE comment_agent = 'comment_agent' ;" );
$comments_ids_strings = "'" . implode( "','", $tutor_comments ) . "'";
$tutor_comments = $wpdb->get_col( "SELECT comment_ID from {$wpdb->comments} WHERE comment_agent = 'comment_agent' ;" );
if ( is_array( $tutor_comments ) && count( $tutor_comments ) ) {
$wpdb->query( "DELETE from {$wpdb->commentmeta} WHERE comment_ID in({$comments_ids_strings}) " ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$in_clause = QueryHelper::prepare_in_clause( $tutor_comments );
$wpdb->query( $wpdb->prepare( "DELETE from {$wpdb->commentmeta} WHERE comment_ID in({$in_clause}) " ) ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
}
$wpdb->delete( $wpdb->comments, array( 'comment_agent' => 'comment_agent' ) );

Expand Down
8 changes: 4 additions & 4 deletions helpers/QueryHelper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
);

if ( $wpdb->last_error ) {
throw new \Exception( $wpdb->last_error );

Check failure on line 44 in helpers/QueryHelper.php

View workflow job for this annotation

GitHub Actions / WPCS 

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$wpdb'.
}

return $insert ? $wpdb->insert_id : 0;
Expand Down Expand Up @@ -144,7 +144,7 @@
$wpdb->query( "DELETE FROM {$table} WHERE id IN ( $ids )");

if ( $wpdb->last_error ) {
throw new \Exception( $wpdb->last_error );

Check failure on line 147 in helpers/QueryHelper.php

View workflow job for this annotation

GitHub Actions / WPCS 

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$wpdb'.
}

return true;
Expand Down Expand Up @@ -229,7 +229,7 @@

// If error occurred then throw new exception.
if ( $wpdb->last_error ) {
throw new \Exception( $wpdb->last_error );

Check failure on line 232 in helpers/QueryHelper.php

View workflow job for this annotation

GitHub Actions / WPCS 

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$wpdb'.
}

if ( $return_ids ) {
Expand Down Expand Up @@ -482,9 +482,9 @@
$ids = $wpdb->get_col( "SELECT comment_id FROM {$wpdb->comments} WHERE {$where}" );//phpcs:ignore

if ( is_array( $ids ) && count( $ids ) ) {
$ids_str = "'" . implode( "','", $ids ) . "'";
$in_clause = self::prepare_in_clause( $ids );
// delete comment metas.
$wpdb->query( "DELETE FROM {$wpdb->commentmeta} WHERE comment_id IN({$ids_str}) " );//phpcs:ignore
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->commentmeta} WHERE comment_id IN({$in_clause}) " ) );//phpcs:ignore
// delete comment.
$wpdb->query( "DELETE FROM {$wpdb->comments} WHERE {$where}" );//phpcs:ignore

Expand Down Expand Up @@ -514,9 +514,9 @@
$ids = $wpdb->get_col( "SELECT id FROM {$wpdb->posts} WHERE {$where}" );//phpcs:ignore

if ( is_array( $ids ) && count( $ids ) ) {
$ids_str = "'" . implode( "','", $ids ) . "'";
$in_clause = self::prepare_in_clause( $ids );
// delete post metas.
$wpdb->query( "DELETE FROM {$wpdb->postmeta} WHERE post_id IN({$ids_str}) " );//phpcs:ignore
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->postmeta} WHERE post_id IN({$in_clause}) " ) );//phpcs:ignore
// delete post.
$wpdb->query( "DELETE FROM {$wpdb->posts} WHERE {$where}" );//phpcs:ignore

Expand Down
4 changes: 2 additions & 2 deletions models/CourseModel.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,9 +506,9 @@

$questions_ids = $wpdb->get_col( $wpdb->prepare( "SELECT question_id FROM {$wpdb->prefix}tutor_quiz_questions WHERE quiz_id = %d ", $content_id ) );
if ( is_array( $questions_ids ) && count( $questions_ids ) ) {
$in_question_ids = "'" . implode( "','", $questions_ids ) . "'";
$in_clause = QueryHelper::prepare_in_clause( $questions_ids );
//phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$wpdb->query( "DELETE FROM {$wpdb->prefix}tutor_quiz_question_answers WHERE belongs_question_id IN({$in_question_ids}) " );
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}tutor_quiz_question_answers WHERE belongs_question_id IN({$in_clause}) " ) );
}
$wpdb->delete( $wpdb->prefix . 'tutor_quiz_questions', array( 'quiz_id' => $content_id ) );
}
Expand Down Expand Up @@ -671,7 +671,7 @@
);

// Check if the current user is an admin.
if ( ! current_user_can( 'administrator' ) ) {

Check failure on line 674 in models/CourseModel.php

View workflow job for this annotation

GitHub Actions / WPCS 

Capabilities should be used instead of roles. Found "administrator" in function call to current_user_can()
$args['author'] = $current_user->ID;
}

Expand Down Expand Up @@ -1108,7 +1108,7 @@
),
);

$courses = current_user_can( 'administrator' ) ? self::get_courses() : self::get_courses_by_instructor();

Check failure on line 1111 in models/CourseModel.php

View workflow job for this annotation

GitHub Actions / WPCS 

Capabilities should be used instead of roles. Found "administrator" in function call to current_user_can()
if ( ! empty( $courses ) ) {
foreach ( $courses as $course ) {
$course_options[] = array(
Expand Down
12 changes: 5 additions & 7 deletions models/QuizModel.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,7 +446,7 @@ public static function get_quiz_attempts( $start = 0, $limit = 10, $search_filte
}

/**
* Delete quizattempt for user
* Delete quiz attempt for user
*
* @since 1.9.5
*
Expand All @@ -457,17 +457,15 @@ public static function get_quiz_attempts( $start = 0, $limit = 10, $search_filte
public static function delete_quiz_attempt( $attempt_ids ) {
global $wpdb;

// Singlular to array.
// Singular to array.
! is_array( $attempt_ids ) ? $attempt_ids = array( $attempt_ids ) : 0;

if ( count( $attempt_ids ) ) {
$attempt_ids = implode( ',', $attempt_ids );
$attempt_ids = QueryHelper::prepare_in_clause( $attempt_ids );

//phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
// Deleting attempt (comment), child attempt and attempt meta (comment meta).
$wpdb->query( "DELETE FROM {$wpdb->prefix}tutor_quiz_attempts WHERE attempt_id IN($attempt_ids)" );
$wpdb->query( "DELETE FROM {$wpdb->prefix}tutor_quiz_attempt_answers WHERE quiz_attempt_id IN($attempt_ids)" );
//phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}tutor_quiz_attempts WHERE attempt_id IN({$attempt_ids})" ) ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}tutor_quiz_attempt_answers WHERE quiz_attempt_id IN({$attempt_ids})" ) ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared

do_action( 'tutor_quiz/attempt_deleted', $attempt_ids );
}
Expand Down
Loading