WordPress Release: 3.7.23

TL;DR

WordPress 3.7.23 restores support for numbered placeholders in wpdb::prepare() queries

This maintenance release fixes a critical database functionality issue introduced in a previous update. WordPress 3.7.23 restores support for numbered placeholders in database queries processed through the wpdb::prepare() method, which was removed in version 3.7.22 despite being widely used by developers. The update also adds additional safety checks to ensure the correct number of arguments are passed to the prepare method based on the number of placeholders in the query.

Highlight of the Release

• Restored support for numbered placeholders in wpdb::prepare() database queries
• Added validation to ensure the correct number of arguments are passed to database queries
• Fixed compatibility issues with plugins and themes that rely on numbered placeholders
• Enhanced security through improved database query parameter validation

Migration Guide

No specific migration steps are required for this update. The release restores functionality that was previously available and widely used, so existing code that relies on numbered placeholders in wpdb::prepare() should continue to work as expected after updating to WordPress 3.7.23.

If you had made changes to your code to work around the removal of numbered placeholders in version 3.7.22, those changes should still be compatible with this release, but you can revert to using numbered placeholders if preferred.

Upgrade Recommendations

Immediate Upgrade Recommended

It is strongly recommended to upgrade to WordPress 3.7.23 as soon as possible, especially if your site uses plugins or themes that might rely on numbered placeholders in database queries. This update restores important functionality that could affect the stability and security of your WordPress installation.

The update is focused on a specific database functionality issue and should be safe to apply with minimal risk of introducing new problems. As always, it's recommended to back up your site before performing any update.

Bug Fixes

Restored Support for Numbered Placeholders

This release fixes a critical issue where support for numbered placeholders in wpdb::prepare() was removed in a previous update (version 3.7.22). Despite being undocumented, numbered placeholders were widely used by developers in WordPress plugins and themes. This fix ensures that code relying on this functionality will continue to work correctly.

Example of restored functionality:

// This syntax now works again
$wpdb->prepare(
    "SELECT * FROM table WHERE id = %1\$d AND name = %2\$s",
    $id,
    $name
);

The update also restores support for a subset of placeholder formatting options that were previously available.

New Features

Enhanced Database Query Parameter Validation

While primarily a bug fix release, WordPress 3.7.23 introduces new validation functionality that ensures the correct number of arguments are passed to wpdb::prepare() based on the number of placeholders in the query. This helps prevent potential errors and security issues that could arise from mismatched parameters.

Security Updates

Improved Database Query Parameter Validation

While not addressing a specific vulnerability, this release enhances security by adding extra validation to ensure that the correct number of arguments are provided to wpdb::prepare() based on the number of placeholders in the query. This helps prevent potential SQL injection vulnerabilities that could arise from improperly formatted queries or mismatched parameters.

Performance Improvements

No specific performance improvements were included in this release. The focus was on restoring compatibility and enhancing security through better parameter validation in database queries.

Impact Summary

WordPress 3.7.23 addresses a significant compatibility issue by restoring support for numbered placeholders in the wpdb::prepare() method. This fix is particularly important because many developers and plugins relied on this functionality despite it being undocumented.

The impact of this release is primarily positive:

1. Restored compatibility: Plugins and themes that use numbered placeholders in database queries will function correctly again.

2. Enhanced security: The addition of validation checks ensures that the correct number of arguments are provided for database queries, reducing the risk of SQL injection vulnerabilities.

3. Reduced development burden: Developers do not need to refactor existing code that relied on numbered placeholders, saving time and reducing the risk of introducing new bugs.

4. Improved stability: Sites using plugins that depend on this functionality will experience fewer errors and more reliable operation.

This release demonstrates WordPress's commitment to maintaining backward compatibility while also enhancing security measures around database operations.