Reviewed SQL sanitization

Author: joeyblake

core/Datastore/Meta_Datastore.php

@@ -71,12 +71,14 @@ public function delete( Field $field ) {
 		);
 		$storage_key_comparisons = $this->key_toolset->storage_key_patterns_to_sql( '`meta_key`', $storage_key_patterns );
 
+		// @codingStandardsIgnoreStart sanitized in `storage_key_patterns_to_sql`
 		$meta_keys = $wpdb->get_col( '
 			SELECT `meta_key`
 			FROM `' . $this->get_table_name() . '`
 			WHERE `' . $this->get_table_field_name() . '` = ' . intval( $this->get_object_id() ) . '
 				AND ' . $storage_key_comparisons . '
 		' );
+		// @codingStandardsIgnoreEnd
 
 		foreach ( $meta_keys as $meta_key ) {
 			delete_metadata( $this->get_meta_type(), $this->get_object_id(), $meta_key );

core/Datastore/Term_Meta_Datastore.php

@@ -49,6 +49,7 @@ public static function create_table() {
 			$charset_collate .= ' COLLATE ' . $wpdb->collate;
 		}
 
+		// @codingStandardsIgnoreStart sanitized above.
 		$wpdb->query( 'CREATE TABLE ' . $wpdb->prefix . 'termmeta (
 			meta_id bigint(20) unsigned NOT NULL auto_increment,
 			term_id bigint(20) unsigned NOT NULL default "0",
@@ -58,6 +59,7 @@ public static function create_table() {
 			KEY term_id (term_id),
 			KEY meta_key (meta_key)
 		) ' . $charset_collate . ';' );
+		// @codingStandardsIgnoreEnd
 	}
 
 	/**

core/Datastore/Theme_Options_Datastore.php

@@ -116,11 +116,13 @@ public function delete( Field $field ) {
 		);
 		$storage_key_comparisons = $this->key_toolset->storage_key_patterns_to_sql( '`option_name`', $storage_key_patterns );
 
+		// @codingStandardsIgnoreStart sanitized in `storage_key_patterns_to_sql`
 		$option_names = $wpdb->get_col( '
 			SELECT `option_name`
 			FROM `' . $wpdb->options . '`
 			WHERE ' . $storage_key_comparisons . '
 		' );
+		// @codingStandardsIgnoreEnd
 
 		foreach ( $option_names as $option_name ) {
 			delete_option( $option_name );

core/Libraries/Sidebar_Manager/Sidebar_Manager.php

@@ -38,7 +38,7 @@ public function action_handler() {
 			'data' => null,
 		);
 
-		$input = stripslashes_deep( $_POST );
+		$input = stripslashes_deep( $_POST ); // CSRF ok. verfied below.
 		$action = isset( $input['action'] ) ? $input['action'] : '';
 		$nonce = isset( $input['nonce'] ) ? $input['nonce'] : '';