[salvatorecorsi]

Trac ticket: https://core.trac.wordpress.org/ticket/60505

wpdb::insert(), replace(), update() and delete() accept raw column names, but interpolate them between backticks before preparing the query. A valid name containing a backtick breaks the SQL, and a name containing %s can be mistaken for a value placeholder.

Pass column names as %i arguments instead. INSERT/REPLACE place the identifier arguments before the value arguments; UPDATE and DELETE keep each identifier beside its optional value. NULL assignments and IS NULL conditions still omit the value argument. Empty INSERT/REPLACE data continues to return false rather than becoming a default-row insert.

This addresses column identifiers across the CRUD methods. It does not change table-name interpolation or introduce new identifier-validity rules. Related PR #9292 changes validation inside prepare(); it does not update these CRUD call sites. The linked public ticket records that the security team reviewed the report and requested a public ticket.

Testing

Use a temporary table with a valid column named back`tick or percent%s, then insert, replace, update and delete through the public CRUD methods. The operations should round-trip their values without SQL errors. The regression tests create and remove their own temporary tables and also cover NULL data/conditions, string/integer/float formats, ordinary column names and zero affected rows.

• The unchanged source fails 12 of the 18 identifier cases; the six ordinary-name controls pass.
• The fixed focused tests pass, including the empty-column-list control (19 tests).
• The complete Tests_DB class passes in single-site and multisite: 531 tests each.
• PHP syntax, coding standards, compatibility and whitespace checks pass.
• Full PHPStan reports three Windows theme documentation-reference errors, reproduced unchanged on the exact base; no errors are reported in the changed production file.

Use of AI Tools

AI assistance: Yes
Tool(s): Codex
Used for: Investigating the ticket and related PRs, implementation, regression tests, validation, and independent automated code review. This contribution has not received a human review from the account owner.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props salvatorecorsi.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.