Wordpress WPDB and Mysql strange behaviour

Question

I am using $wpdb and the following is part of the codes that calls $wpdb->update.

This code works well if it's normal [email protected], but when if users were to use the + sign in their username, e.g. [email protected], wpdb doesn't read the + sign

Below variables are from $_GET but i'm putting in values for readability.

$open_email = '[email protected]';
$open_key = '2f1e4b16a9a882bbef9b00906fc5c8f563fd70a5';
$open_time = time();

if (strlen($open_key) == 40) {
    $status_update = $wpdb->update('status', 
            array(
                'invite_status' => 'opened',
                'open_time' => $open_time
                ),
            array(
                'invite_email' => $open_email,
                'invite_token' => $open_key
                ),
            array(
                '%s',
                '%d'
                ),
            array(
                '%s',
                '%s'
                )
                );
}

var dump of $wpdb->last_query and $wpdb->last_error returns the followings.

string(235) "UPDATE status SET invite_status = 'opened', open_time = 1461103507 WHERE invite_email = 'something [email protected]' AND rating_invite_token = '2f1e4b16a9a882bbef9b00906fc5c8f563fd70a5'"

I notice above part in error, highlighted in bold, that my plus (+) sign is gone and it left a space, causing the above statement not to update.

May I know am I missing out anything?

Update: I am asking because some users of gmails does use the + sign to categorise their emails, as [email protected] still goes back to [email protected]

If there's any sanitisation which I am supposed to do, but i miss out, please guide me as well. I presume all $_GET data should have been sanitised.

drew010 · Accepted Answer · 2016-04-19 22:30:09Z

3

It isn't wpdb or MySQL that's removing the plus.

Under the hood, when you call update like that, WordPress is passing the data through mysqli_real_escape_string() and nothing else.

Since you mentioned the data is coming from the query string $_GET, most likely the + is being removed before the query because it us being unescaped and the + is being translated into a space.

You can check this with:

$open_email = $_GET['email'];
var_dump($open_email);

and see what the result is.

To get the plus back, it should be safe to do the following after all sanitzation and unescaping:

$open_email = str_replace(' ', '+', $open_email);

answered Apr 19, 2016 at 22:30

drew010

70.3k11 gold badges144 silver badges174 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Someone Special Over a year ago

Oh yes, you are spot on! May I assume this is a common problem and str_replace(' ', '+',$open_email); is a common step to do after a GET with email string?

drew010 Over a year ago

Yes and no, if you really want the + to be a plus, the URL should be hex encoded properly from the source, e.g. http://example.com?email=something%2bADDITION%40gmail.com&open_key=xxx A + in a URL is special encoding for a space, if you want to actually represent a +, hex encode it as %2b

Collectives™ on Stack Overflow

Wordpress WPDB and Mysql strange behaviour

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related