backtick column names

[nebbens]

Impacted plugin

Jetpack

Quick summary

I would like to request a code change. I would like to request that backticks be added to the column names in the method: Jetpack_Sitemap_Librarian::get_sanitized_post_columns($wpdb). I’m sure it can be done different ways, but I solved it temporarily by changing line 483 to:

return '`' . implode( '`,`', array_map( 'esc_sql', $columns ) ) . '`';

I was getting a sql error due to having a column name that is a keyword (order) in my wp_posts table. I’m not sure what plugin added that column in the past (nor whether it is even used still), but surrounding the column names with backticks takes care of the problem.

This problem was discovered when it conflicted with Solid Backups Legacy plugin causing the backup to fail.

Thank you for considering this change.

Steps to reproduce

Add a column to the wp_posts table which is a reserved word.

Site owner impact

Fewer than 20% of the total website/platform users

Severity

Major

What other impact(s) does this issue have?

No response

If a workaround is available, please outline it here.

In Jetpack_Sitemap_Librarian::get_sanitized_post_columns($wpdb),
change line 483 to:

return '`' . implode( '`,`', array_map( 'esc_sql', $columns ) ) . '`';

Platform (Simple and/or Atomic)

No response

[anomiex]

Better would probably be to return the list of columns as an array, maybe along with an appropriate %i,%i,%i-type string to use in the $wpdb->prepare() call.

Alternatively, use the correct function $wpdb->quote_identifier() rather than esc_sql() when building the string. esc_sql() is for string contents, not identifiers like column names.