Sitemaps: backtick column names via `%i` placeholders by StefMattana · Pull Request #48533 · Automattic/jetpack

StefMattana · 2026-05-05T16:06:19Z

Jetpack_Sitemap_Librarian::get_sanitized_post_columns() was running column names through esc_sql(), which is for string values, not identifiers. If wp_posts had a column whose name was a reserved SQL keyword (e.g. order), the resulting SELECT would error out.

As suggested in the issue thread, switching to %i identifier placeholders in wpdb::prepare() is the idiomatic fix.
It backtick-quotes and escapes identifiers correctly. The helper now returns both the placeholder string and the column array; both call sites splat the array into prepare().

Includes a regression test that adds an order column to wp_posts, runs the query, and asserts it succeeds.
Reported by @nebbens, with the suggested approach from @anomiex.

Copilot

Pull request overview

This PR updates Jetpack’s sitemaps librarian to build post-column SELECT lists with identifier placeholders so sitemap queries keep working when wp_posts contains reserved-word column names. It fits into the sitemaps subsystem by hardening both the main sitemap and news sitemap post-fetch queries.

Changes:

Reworks get_sanitized_post_columns() to return %i placeholder SQL plus the corresponding column names for wpdb::prepare().
Applies that prepared column list to both query_posts_after_id() and query_most_recent_posts().
Adds a regression test for a reserved-keyword wp_posts column and records the fix in the Jetpack changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`projects/plugins/jetpack/modules/sitemaps/sitemap-librarian.php`	Switches sitemap post queries to prepared identifier placeholders for column names.
`projects/plugins/jetpack/tests/php/modules/sitemaps/Jetpack_Sitemap_Librarian_Test.php`	Adds a regression test that alters `wp_posts` to include a reserved-word column.
`projects/plugins/jetpack/changelog/fix-48202-sitemap-backtick-columns`	Adds the Jetpack changelog entry for the sitemap SQL fix.

+		// Add a column whose name is a reserved SQL keyword.
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.SchemaChange,WordPress.DB.DirectDatabaseQuery.NoCaching
+		$wpdb->query( "ALTER TABLE {$wpdb->posts} ADD COLUMN `order` INT NULL" );


+		} finally {
+			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.SchemaChange,WordPress.DB.DirectDatabaseQuery.NoCaching
+			$wpdb->query( "ALTER TABLE {$wpdb->posts} DROP COLUMN `order`" );


+		$columns = $this->get_sanitized_post_columns( $wpdb );

 		// phpcs:disable WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder,WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- WPCS: db call ok; no-cache ok.
 		return $wpdb->get_results(
 			$wpdb->prepare(
-				"SELECT $columns_list
+				"SELECT {$columns['placeholders']}


…in test

github-actions · 2026-05-05T16:53:20Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack), and enable the fix/48202-sitemap-backtick-columns branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack fix/48202-sitemap-backtick-columns

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2026-05-05T16:53:37Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
🔴 Add testing instructions.
🔴 Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

🔴 Action required: Please include detailed testing steps, explaining how to test your change, like so:

## Testing instructions:

* Go to '..'
*

🔴 Action required: We would recommend that you add a section to the PR description to specify whether this PR includes any changes to data or privacy, like so:

## Does this pull request change what data or activity we track or use?

My PR adds *x* and *y*.

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Jetpack plugin:

No scheduled milestone found for this plugin.

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

jp-launch-control · 2026-05-05T17:02:35Z

Code Coverage Summary

Coverage changed in 1 file.

File	Coverage	Δ%	Δ Uncovered
projects/plugins/jetpack/modules/sitemaps/sitemap-librarian.php	89/167 (53.29%)	16.71%	-26 💚

Full summary · PHP report · JS report

StefMattana · 2026-05-05T17:13:21Z

Hey @anomiex! Would you terribly mind taking a look at this PR? I was working on it within our Bug Blitz project - the issue was added in this list on Linear :) TIA!

anomiex

Looks reasonable. I flagged fixes for the linting errors.

anomiex · 2026-05-08T17:16:30Z


 		// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- WPCS: db call ok; no-cache ok.
 		return $wpdb->get_results(
 			$wpdb->prepare(


The lint issue on this line is doubly confused. Best to suppress it.

Suggested change

$wpdb->prepare(

// phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber -- Sniff is confused by both the interpolation of `$columns['placeholders']` and the spread.

$wpdb->prepare(

anomiex · 2026-05-08T17:16:55Z


 		// phpcs:disable WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder,WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- WPCS: db call ok; no-cache ok.
 		return $wpdb->get_results(
 			$wpdb->prepare(


Same as above

Suggested change

$wpdb->prepare(

// phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber -- Sniff is confused by both the interpolation of `$columns['placeholders']` and the spread.

$wpdb->prepare(

StefMattana self-assigned this May 5, 2026

Copilot AI review requested due to automatic review settings May 5, 2026 16:06

StefMattana added Bug When a feature is broken and / or not performing as intended [Status] Needs Review This PR is ready for review. Plugin Search aka Feature Hints [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ labels May 5, 2026

Copilot started reviewing on behalf of StefMattana May 5, 2026 16:07 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Stef Mattana added 2 commits May 5, 2026 17:52

Sitemaps: backtick column names via %i placeholders (fixes #48202)

3971839

Fix positional args after spread in wpdb->prepare, guard ALTER TABLE …

a1c4b5e

…in test

StefMattana force-pushed the fix/48202-sitemap-backtick-columns branch from a799522 to a1c4b5e Compare May 5, 2026 16:52

github-actions Bot added [Feature] Sitemaps [Tests] Includes Tests labels May 5, 2026

github-actions Bot added [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. and removed [Status] Needs Review This PR is ready for review. labels May 5, 2026

StefMattana assigned anomiex May 5, 2026

anomiex reviewed May 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sitemaps: backtick column names via `%i` placeholders #48533

Sitemaps: backtick column names via `%i` placeholders #48533
StefMattana wants to merge 2 commits intotrunkfrom
fix/48202-sitemap-backtick-columns

StefMattana commented May 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

jp-launch-control Bot commented May 5, 2026

Uh oh!

StefMattana commented May 5, 2026 •

edited

Loading

Uh oh!

anomiex left a comment

Uh oh!

anomiex May 8, 2026

Uh oh!

anomiex May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	$wpdb->prepare(
	// phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber -- Sniff is confused by both the interpolation of `$columns['placeholders']` and the spread.
	$wpdb->prepare(

Conversation

StefMattana commented May 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

jp-launch-control Bot commented May 5, 2026

Code Coverage Summary

Uh oh!

StefMattana commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anomiex left a comment

Choose a reason for hiding this comment

Uh oh!

anomiex May 8, 2026

Choose a reason for hiding this comment

Uh oh!

anomiex May 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented May 5, 2026 •

edited

Loading

StefMattana commented May 5, 2026 •

edited

Loading