Proper and standard use of $wpdb->prepare

[farhadsakhaei]

Hi,

Bug Description

I am developing a plugin and I use WordPress standard (Code Sniffer)
But I get the following standard error on this code
I need to know how can I use $wpdb->prepare in the following code to pass the standard?

Minimal Code Snippet

$get_order = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table_name} WHERE order_id = %d", $order_id ) );

I get this error:

Use placeholders and $wpdb->prepare(); found interpolated variable {$table_name} at "SELECT * FROM {$table_name} WHERE order_id = %d"

“code”: “WordPress.DB.PreparedSQL.InterpolatedNotPrepared”,
“severity”: 8,
“message”: “Use placeholders and $wpdb->prepare(); found interpolated variable {$table_name} at \”SELECT * FROM {$table_name} WHERE order_id = %d\””,
“source”: “PHPCS”,

Could you please mention a standard way of using $wpdb->prepare containing a table name variable?
When I use table name as a place holder in $wpdb->prepare, I get another SQL error because it adds ' sign around the table name!!

Thank you for any help

[dingo-d]

If this is a custom table name, you can either pass it as a parameter to the prepare statement or use:

"SELECT * FROM {$wpdb->prefix}_table_name WHERE..."

the table name could be something like wc_orders_meta.

You'll still get the Use of a direct database call is discouraged. (WordPress.DB.DirectDatabaseQuery.DirectQuery) error.

I'd recommend using native WooCommerce (from the looks of the DB query) functions to get information about the order like

$order = wc_get_order( $order_id );

[farhadsakhaei]

Hi @dingo-d, Thank you for your reply,

As you can see I used {$table_name} in the string,
I can't use table name as a place holder in $wpdb->prepare because I get SQL error (because of adding ' sign around name)
And this is not a Woocommerce plugin
Still I get ERROR, Not Warning:

[{
	"code": "WordPress.DB.PreparedSQL.InterpolatedNotPrepared",
	"severity": 8,
	"message": "Use placeholders and $wpdb->prepare(); found interpolated variable {$table_name} at \"SELECT * FROM {$table_name} WHERE order_id = %d\"",
	"source": "PHPCS"
}]

[dingo-d]

Take a look at this update.

You can use this:

$table_name = 'your_table_name';
$field = 'order_id';
$order_id = ''; // Your order ID.

$get_order = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM %i WHERE %i = %d", $table_name, $field, $order_id ) );

[farhadsakhaei]

@dingo-d
Great, Thank you so much for your help