Merge pull request #2569 from rodrigoprimo/prepared-sql-placeholders-false-negative

DB/PreparedSQLPlaceholders: fix false negative when checking quotes in dynamic generated placeholders

Author: dingo-d

WordPress/Sniffs/DB/PreparedSQLPlaceholdersSniff.php

@@ -266,8 +266,13 @@ public function process_token( $stackPtr ) {
 						unset( $sprintf_parameters, $valid_sprintf, $last_param );
 
 					} elseif ( 'implode' === strtolower( $this->tokens[ $i ]['content'] ) ) {
+						$ignore_tokens = Tokens::$emptyTokens + array(
+							\T_STRING_CONCAT => \T_STRING_CONCAT,
+							\T_NS_SEPARATOR  => \T_NS_SEPARATOR,
+						);
+
 						$prev = $this->phpcsFile->findPrevious(
-							Tokens::$emptyTokens + array( \T_STRING_CONCAT => \T_STRING_CONCAT ),
+							$ignore_tokens,
 							( $i - 1 ),
 							$query['start'],
 							true

WordPress/Tests/DB/PreparedSQLPlaceholdersUnitTest.inc

@@ -148,7 +148,7 @@ $where = $wpdb->prepare(
 	"{$wpdb->posts}.post_type IN (\""
 		. implode( ',', array_fill( 0, count($post_types), '%s' ) )
 		. "\") AND {$wpdb->posts}.post_status IN ('"
-		. implode( ',', array_fill( 0, count($post_statusses), '%s' ) )
+		. \implode( ',', array_fill( 0, count($post_statusses), '%s' ) )
 		. '\')',
 	array_merge( $post_types, $post_statusses )
 ); // Bad x 2 - quotes between the () for the IN.