WordPress WPDB and Mysql strange behaviour

2 Views

I am using $wpdb and the following is part of the codes that calls $wpdb->update.

This code works well if it’s normal email@domain.com, but when if users were to use the + sign in their username, e.g. email+something@domain.com, wpdb doesn’t read the + sign

Read More

Below variables are from $_GET but i’m putting in values for readability. 

$open_email = 'something+ADDITION@gmail.com';
$open_key = '2f1e4b16a9a882bbef9b00906fc5c8f563fd70a5';
$open_time = time();

if (strlen($open_key) == 40) {
    $status_update = $wpdb->update('status', 
            array(
                'invite_status' => 'opened',
                'open_time' => $open_time
                ),
            array(
                'invite_email' => $open_email,
                'invite_token' => $open_key
                ),
            array(
                '%s',
                '%d'
                ),
            array(
                '%s',
                '%s'
                )
                );
}

var dump of $wpdb->last_query and $wpdb->last_error returns the followings.

string(235) “UPDATE status SET invite_status = ‘opened’, open_time = 1461103507 WHERE invite_email = ‘something ADDITION@gmail.com‘ AND rating_invite_token = ‘2f1e4b16a9a882bbef9b00906fc5c8f563fd70a5′”

I notice above part in error, highlighted in bold, that my plus (+) sign is gone and it left a space, causing the above statement not to update.

May I know am I missing out anything?

Update: I am asking because some users of gmails does use the + sign to categorise their emails, as username+anything@gmail.com still goes back to username@gmail.com

If there’s any sanitisation which I am supposed to do, but i miss out, please guide me as well. I presume all $_GET data should have been sanitised.

Post Views: 2

Related posts

1 comment

  1. It isn’t wpdb or MySQL that’s removing the plus.

    Under the hood, when you call update like that, WordPress is passing the data through mysqli_real_escape_string() and nothing else.

    Since you mentioned the data is coming from the query string $_GET, most likely the + is being removed before the query because it us being unescaped and the + is being translated into a space.

    You can check this with:

    $open_email = $_GET['email'];
var_dump($open_email);

    and see what the result is.

    To get the plus back, it should be safe to do the following after all sanitzation and unescaping:

    $open_email = str_replace(' ', '+', $open_email);

Comments are closed.