[wp-trac] [WordPress Trac] #39785: posts_selection hook incorrectly concatenates selection query strings

[WordPress Trac]

#39785: posts_selection hook incorrectly concatenates selection query strings
-------------------------------+-----------------------------
 Reporter:  bigevilbrain       |      Owner:
     Type:  defect (bug)       |     Status:  new
 Priority:  normal             |  Milestone:  Awaiting Review
Component:  Posts, Post Types  |    Version:  4.7.2
 Severity:  normal             |   Keywords:
  Focuses:                     |
-------------------------------+-----------------------------
 "posts_selection" hook incorrectly concatenates selection query strings.
 Documentation states this is "For use by caching plugins". Perhaps valid
 SQL is not need here?

 In "wp-includes/class-wp-query.php" in the "get_posts" function:
 {{{#!php
 do_action( 'posts_selection', $where . $groupby . $orderby . $limits .
 $join );
 }}}

 Missing spaces can result in improper concatenation of the assembled
 selection query under certain circumstances:

 '''$groupby''', '''$orderby''' and '''$limits''' do not have spaces in
 front of the values:

 Here are values created by a custom query:
 {{{
 where = " AND ( ( wp_postmeta.meta_key = '_pt_event-date' AND
 CAST(wp_postmeta.meta_value AS DATE) BETWEEN '2017-02-12' AND '2017-03-06'
 ) ) AND wp_posts.post_type = 'event' AND ((wp_posts.post_status =
 'publish'))"

 groupby = "wp_posts.ID" // <-- No leading space

 orderby = "wp_posts.post_date DESC" // <-- No leading space

 limits = "LIMIT 0, 3" // <-- No leading space

 join = " INNER JOIN wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id )"
 }}}

 Note this output in the lines below:
 '''wp_posts.IDwp_posts.post_date DESCLIMIT 0, 3'''

 Here is the resulting values announced by the hook:
 {{{#!php
 posts_selection = " AND ( ( wp_postmeta.meta_key = '_pt_event-date' AND
 CAST(wp_postmeta.meta_value AS DATE) BETWEEN '2017-02-12' AND '2017-03-06'
 ) ) AND wp_posts.post_type = 'event' AND ((wp_posts.post_status =
 'publish'))wp_posts.IDwp_posts.post_date DESCLIMIT 0, 3 INNER JOIN
 wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id )"
 }}}

 How to recreate:
 This WP_Query acts on a custom post type, however can be see in ALL
 get_post calls:
 {{{#!php
 <?php
         $wp_query = null;
         $wp_query = new WP_Query();

         $defaults['post_type'] = 'event';
         $defaults['meta_key'] = '_pt_event-date';
         $defaults['meta_type'] = 'DATE';
         $defaults['meta_value'] = array(
                 date('Y-m-d', time() + (8 * 24 * 60 * 60)),
                 date('Y-m-d', time() + (30 * 24 * 60 * 60))
         );
         $defaults['meta_compare'] = 'BETWEEN';
         $defaults['orderby'] = '_pt_event-location'; // meta_value_num
         $defaults['order'] = 'DESC';
         $defaults['post_status'] = 'publish';
         $defaults['posts_per_page'] = 3;

         $wp_query->query($defaults); // posts_per_page
 ?>
 }}}

--
Ticket URL: <https://core.trac.wordpress.org/ticket/39785>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform