: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* Class PPW_Repository_Passwords
if ( ! defined( 'ABSPATH' ) ) {
if ( ! class_exists( 'PPW_Repository_Passwords' ) ) {
* DB class to create table and manage version
class PPW_Repository_Passwords {
* Instance of PPW_Pro_Shortcode class.
* @var PPW_Repository_Passwords
protected static $instance = null;
* PPW_Pro_DB constructor.
public function __construct( $prefix = false ) {
$this->tbl_version = $this->get_table_version();
$this->tbl_name = ! $prefix ? $this->wpdb->prefix . PPW_Constants::TBL_NAME : $prefix . PPW_Constants::TBL_NAME;
* Get short code instance
* @return PPW_Repository_Passwords
public static function get_instance() {
if ( is_null( self::$instance ) ) {
// Use static instead of self due to the inheritance later.
// For example: ChildSC extends this class, when we call get_instance
// it will return the object of child class. On the other hand, self function
// will return the object of base class.
self::$instance = new static();
public function install() {
// TODO: Check highest version to create table.
foreach ( PPW_Constants::DB_DATA_COLUMN_TABLE as $data ) {
$this->add_new_column( $data['old_version'], $data['new_version'], $data['value'] );
foreach ( PPW_Constants::DB_UPDATE_COLUMN_TABLE as $dt ) {
$this->update_table( $dt['old_version'], $dt['new_version'], $dt['value'] );
// TODO: Add column for pro version.
$this->update_label_and_post_types_column();
public function uninstall() {
$this->wpdb->query( "DROP TABLE IF EXISTS $this->tbl_name" ); // phpcs:ignore -- We do not need to prepare because don't have any param to pass.
private function init_tbl() {
if ( $this->is_table_does_not_exist() ) {
$charset_collate = $this->wpdb->get_charset_collate();
$sql = "CREATE TABLE $this->tbl_name (
id mediumint(9) NOT NULL AUTO_INCREMENT,
post_id mediumint(9) NOT NULL,
contact_id mediumint(9) NULL,
campaign_app_type varchar(50) DEFAULT '' NULL,
password varchar(30) NOT NULL,
is_activated tinyint(1) DEFAULT 1,
created_time BIGINT DEFAULT NULL,
expired_time BIGINT DEFAULT NULL,
require_once ABSPATH . 'wp-admin/includes/upgrade.php';
// Init setting when installing plugin firstly.
update_option( PPW_Constants::MISC_OPTIONS, wp_json_encode( array( 'wpp_use_custom_form_action' => 'true' ) ), 'no' );
$this->tbl_version = "1.0";
$this->update_table_version( $this->tbl_version );
* Add new column for table
private function add_new_column( $old_version, $new_version, $value ) {
if ( $this->tbl_version === $old_version ) {
if ( is_null( $this->check_column_exist( $value ) ) ) {
$charset_collate = $this->wpdb->get_charset_collate();
$sql = "CREATE TABLE $this->tbl_name ( $value ) $charset_collate;";
require_once ABSPATH . 'wp-admin/includes/upgrade.php';
$this->tbl_version = $new_version;
$this->update_table_version( $this->tbl_version );
* Update value for column in table
private function update_table( $old_version, $new_version, $value ) {
if ( $this->tbl_version === $old_version ) {
$sql = "ALTER TABLE $this->tbl_name CHANGE $value";
require_once ABSPATH . 'wp-admin/includes/upgrade.php';
$this->wpdb->query( $sql ); // phpcs:ignore -- We don't need to prepare this one.
$this->tbl_version = $new_version;
$this->update_table_version( $this->tbl_version );
private function is_table_does_not_exist() {
$preparation = $this->wpdb->prepare( 'SHOW TABLES LIKE %s', $this->tbl_name );
return $this->wpdb->get_var( $preparation ) != $this->tbl_name; // phpcs:ignore -- we already prepared above, but there are no data to prepare
* Get the plugin table's version
private function get_table_version() {
$version = get_option( PPW_Constants::TBL_VERSION, false );
return ! $version ? '1.0' : $version;
private function update_table_version( $version ) {
update_option( PPW_Constants::TBL_VERSION, $version );
* Get password info by password and post id
* @param string $password The password.
public function get_master_password_info_by_password( $password ) {
$like_master_param = 'master_';
$query_string = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE BINARY password = %s and campaign_app_type LIKE %s and post_id = 0 and is_activated = 1 and (expired_date is NULL OR expired_date > UNIX_TIMESTAMP()) and (usage_limit is NULL OR hits_count < usage_limit)", $password, $this->wpdb->esc_like( $like_master_param ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $query_string ); // phpcs:ignore -- we already prepared above
* Get master password which activating.
* @return array|object|null Database query results.
public function get_activate_master_passwords_info() {
$like_master_param = 'master_';
$query_string = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE post_id = 0 AND campaign_app_type LIKE %s and is_activated = 1", $this->wpdb->esc_like( $like_master_param ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder.
return $this->wpdb->get_results( $query_string ); // phpcs:ignore -- we already prepared above
* Get master password which in database.
* @return array|object|null Database query results.
public function get_master_passwords_info() {
$like_master_param = 'master_';
$query_string = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE post_id = 0 AND campaign_app_type LIKE %s", $this->wpdb->esc_like( $like_master_param ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_results( $query_string ); // phpcs:ignore -- we already prepared above
* Add a row in table by id.
* @param array $data Data to add.
* @return int|false The number of rows updated, or false on error.
public function add_new_password( $data ) {
$is_added = $this->wpdb->insert( $this->tbl_name, $data );
return $this->wpdb->insert_id;
public function delete_passwords( $ids, $post_id ) {
$ids = implode( ',', array_map( 'absint', $ids ) );
$post_id = absint( $post_id );
$query_string = $this->wpdb->prepare( "DELETE FROM {$this->tbl_name} WHERE id IN(%1s) AND post_id = %d", $ids, $post_id ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder -- We don't want to set table name as placeholder and put the $ids in quotes.
$this->wpdb->query( $query_string ); // phpcs:ignore -- we already prepared above
* Find password by post ID.
* @param string $password Password.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function find_by_master_password( $password ) {
$like_master_param = 'master_';
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE BINARY password = %s AND post_id = 0 AND campaign_app_type LIKE %s", $password, $this->wpdb->esc_like( $like_master_param ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $sql ); // phpcs:ignore -- we already prepared above
* Find shared category password.
* @param string $password Password.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function find_by_shared_category_password( $password ) {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE BINARY password = %s AND post_id = 0 AND campaign_app_type = %s", $password, PPW_Category_Service::SHARED_CATEGORY_TYPE ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $sql ); // phpcs:ignore -- we already prepared above
* Get all shared categories password.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function get_all_shared_categories_password() {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE post_id = 0 AND campaign_app_type = %s", PPW_Category_Service::SHARED_CATEGORY_TYPE ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_results( $sql ); // phpcs:ignore -- we already prepared above
public function get_passwords_with_type_and_post_id( $type, $post_id, $column = '*' ) {
$sql = $this->wpdb->prepare( "SELECT %1s FROM {$this->tbl_name} WHERE post_id = %d AND campaign_app_type = %s", $column, $post_id, $type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder -- We don't want to set table name as placeholder, and put $column in quotes.
return $this->wpdb->get_results( $sql ); // phpcs:ignore -- we already prepared above
* Get all custom categories's password
public function get_all_custom_categories_password( $taxonomy_type ) {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE post_id = 0 AND campaign_app_type = %s", $taxonomy_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_results( $sql ); // phpcs:ignore -- we already prepared above
* Check password with custom category type.
public function find_by_shared_custom_category_password( $password, $taxonomy_type ) {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE BINARY password = %s AND post_id = 0 AND campaign_app_type = %s", $password, $taxonomy_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $sql ); // phpcs:ignore -- we already prepared above
* Get shared category password by password ID.
* @param int $password_id Password ID.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function get_shared_category_password( $password_id ) {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE BINARY id = %d AND campaign_app_type = %s", $password_id, PPW_Category_Service::SHARED_CATEGORY_TYPE ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $sql ); // phpcs:ignore -- we already prepared above
* Get shared category password by password ID.
* @param int $password_id Password ID.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function get_shared_custom_category_password( $password_id, $taxonomy ) {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->tbl_name} WHERE id = %d AND campaign_app_type = %s", $password_id, $taxonomy ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_row( $sql ); // phpcs:ignore -- we already prepared above
* Delete a row in table by id.
* @return int|false The number of rows updated, or false on error.
public function delete( $id ) {
return $this->wpdb->delete(
* Update a row in table by id.
* @param array $data Data to update.
* @return int|false The number of rows updated, or false on error.
public function update_password( $id, $data ) {
return $this->wpdb->update(
* Update label and post types column.
public function update_label_and_post_types_column() {
$this->add_new_column( '1.6', '1.7', 'label TINYTEXT' );
$this->add_new_column( '1.7', '1.8', 'post_types varchar(255)' );
$this->add_new_column( '1.8', '1.9', 'protection_types varchar(50)' );
* Check column exist in database.
* @param string $value Value to add new column.
* @return string|null|false Database query result (as string), or null on failure
* @since 1.4.0 Init function.
private function check_column_exist( $value ) {
$value_patterns = explode( ' ', $value );
$field_name = $value_patterns[0];
$query = $this->wpdb->prepare( "SHOW COLUMNS FROM {$this->tbl_name} LIKE %s", $this->wpdb->esc_like( $field_name ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_var( $query ); // phpcs:ignore -- we already prepared above
* Get all backup post password.
* @return array|object|void|null Database query result in format specified by $output or null on failure
public function get_wp_post_passwords() {
$sql = $this->wpdb->prepare( "SELECT * FROM {$this->wpdb->postmeta} WHERE meta_key = %s", 'ppwp_post_password_bk' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_results( $sql ); // phpcs:ignore -- we already prepared above
* Count all backup post password.
* @return int - number for count
public function count_wp_post_passwords() {
$sql = $this->wpdb->prepare( "SELECT COUNT(*) FROM {$this->wpdb->postmeta} WHERE meta_key = %s", 'ppwp_post_password_bk' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder
return $this->wpdb->get_var( $sql ); // phpcs:ignore -- we already prepared above
* Delete selected passwords by id
* String will convert to int
* @param array $selected_ids ID Passwords selected.
public function bulk_delete_passwords( $selected_ids ) {
$selected_ids = implode( ',', array_map( 'absint', $selected_ids ) );
$query_string = $this->wpdb->prepare( "DELETE FROM {$this->tbl_name} WHERE ID IN(%1s)", $selected_ids ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder -- We don't want to set table name as placeholder and put the $ids in quotes.
return $this->wpdb->query( $query_string ); // phpcs:ignore -- we already prepared above
* Delete all expired master password
public function delete_all_expired_password( $ids, $campaign_app_type) {
return $this->wpdb->query($this->wpdb->prepare( "DELETE FROM $this->tbl_name WHERE `campaign_app_type` LIKE '%$campaign_app_type%' and `expired_date` < UNIX_TIMESTAMP(NOW()) or `hits_count` >= `usage_limit`"));
//return $this->wpdb->query($this->wpdb->prepare( "DELETE FROM $this->tbl_name WHERE `campaign_app_type` = %s", $campaign_app_type));
public function delete_passwords_by_post_id( $post_id ) {
return $this->wpdb->delete(
'post_id' => absint( $post_id ),
public function find_activated_password( $password, $params ) {
'allow_to_check_expired' => true,
if ( $args['role_type'] ) {
$like_where = $this->generate_where_like_for_roles( $args['roles'], $args['role_type'] );
if ( $args['allow_to_check_expired'] ) {
$expired_where = ' AND (expired_date IS NULL OR expired_date > UNIX_TIMESTAMP()) AND (usage_limit IS NULL OR hits_count < usage_limit) ';
$query = $this->wpdb->prepare(
"SELECT * FROM {$this->tbl_name} WHERE BINARY password = %s AND is_activated = 1 AND ( campaign_app_type = %s {$like_where}) AND post_id = %d {$expired_where}", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- We don't want to set table name as placeholder and put the extended where sql query in quotes.
return $this->wpdb->get_row( $query ); // phpcs:ignore -- we already prepared above
public function find_activated_passwords_by_ids( $password_ids, $params ) {
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
