WP_Date_Query::validate_column( string $column ): string

Source

public function validate_column( $column ) {
	global $wpdb;

	$valid_columns = array(
		'post_date',
		'post_date_gmt',
		'post_modified',
		'post_modified_gmt',
		'comment_date',
		'comment_date_gmt',
		'user_registered',
		'registered',
		'last_updated',
	);

	// Attempt to detect a table prefix.
	if ( ! str_contains( $column, '.' ) ) {
		/**
		 * Filters the list of valid date query columns.
		 *
		 * @since 3.7.0
		 * @since 4.1.0 Added 'user_registered' to the default recognized columns.
		 * @since 4.6.0 Added 'registered' and 'last_updated' to the default recognized columns.
		 *
		 * @param string[] $valid_columns An array of valid date query columns. Defaults
		 *                                are 'post_date', 'post_date_gmt', 'post_modified',
		 *                                'post_modified_gmt', 'comment_date', 'comment_date_gmt',
		 *                                'user_registered', 'registered', 'last_updated'.
		 */
		if ( ! in_array( $column, apply_filters( 'date_query_valid_columns', $valid_columns ), true ) ) {
			$column = 'post_date';
		}

		$known_columns = array(
			$wpdb->posts    => array(
				'post_date',
				'post_date_gmt',
				'post_modified',
				'post_modified_gmt',
			),
			$wpdb->comments => array(
				'comment_date',
				'comment_date_gmt',
			),
			$wpdb->users    => array(
				'user_registered',
			),
			$wpdb->blogs    => array(
				'registered',
				'last_updated',
			),
		);

		// If it's a known column name, add the appropriate table prefix.
		foreach ( $known_columns as $table_name => $table_columns ) {
			if ( in_array( $column, $table_columns, true ) ) {
				$column = $table_name . '.' . $column;
				break;
			}
		}
	}

	// Remove unsafe characters.
	return preg_replace( '/[^a-zA-Z0-9_$\.]/', '', $column );
}

View all references View on Trac View on GitHub