Sitemaps: wrap column names in backticks to prevent SQL errors with reserved words

[shsajalchowdhury]

Fixes #48202

Proposed changes

The get_sanitized_post_columns() method in Jetpack_Sitemap_Librarian returns column names without backtick quoting. If a wp_posts column name matches a MySQL reserved word (e.g. order), the generated SELECT query fails with a SQL error.

This PR wraps each column name in backticks to ensure compatibility regardless of column names.

Before:

return implode( ',', array_map( 'esc_sql', $columns ) );

Produces: ID,post_author,post_date,...,order (breaks SQL)

After:

return '`' . implode( '`,`', array_map( 'esc_sql', $columns ) ) . '`';

Produces: ID,post_author,post_date,...,order (works correctly)

Related product discussion/links

• Issue backtick column names #48202 reported the bug with a suggested fix.

Does this pull request change what data or activity we track or use?

No. This change only affects how SQL column names are quoted in sitemap queries. No data collection, tracking, or privacy-related changes.

Testing instructions

1. Add a custom column to the wp_posts table with a MySQL reserved word name (e.g. order):

   ALTER TABLE wp_posts ADD COLUMN `order` INT DEFAULT 0;

2. Enable Jetpack Sitemaps (Settings > Traffic > Sitemaps).
3. Trigger sitemap generation by visiting a sitemap URL (e.g. /sitemap.xml).
4. Before this fix: A SQL error occurs because order is interpreted as the SQL ORDER keyword rather than a column name.
5. After this fix: The query succeeds because the column name is properly backtick-quoted as `order`.
6. Remove the test column: ALTER TABLE wp_posts DROP COLUMN order;

Alternatively, review the code change directly — it adds backtick wrapping to column names in the return value of get_sanitized_post_columns(), which is used in two SELECT queries in the same file.

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

---

Jetpack plugin:

The Jetpack plugin has different release cadences depending on the platform:

• WordPress.com Simple releases happen as soon as you deploy your changes after merging this PR (PCYsg-Jjm-p2).
• WoA releases happen weekly.
• Releases to self-hosted sites happen monthly:
  • Scheduled release: May 5, 2026
  • Code freeze: May 4, 2026

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

[jeherve]

There was a proposal for a different approach here:
#48202 (comment)

I would recommend trying this out instead.