Skip to content

Fix best-seller ORDER BY handling to prevent SQL syntax errors#938

Merged
CySSoO merged 1 commit intomasterfrom
cyssoo/fix-sql-syntax-error-in-hookactionoutputhtmlbefore-uxyyq6
Feb 3, 2026
Merged

Fix best-seller ORDER BY handling to prevent SQL syntax errors#938
CySSoO merged 1 commit intomasterfrom
cyssoo/fix-sql-syntax-error-in-hookactionoutputhtmlbefore-uxyyq6

Conversation

@CySSoO
Copy link
Contributor

@CySSoO CySSoO commented Feb 3, 2026

Motivation

  • Prevent malformed or ambiguous ORDER BY clauses in best-seller queries that could produce SQL syntax errors (observed error near LIMIT).
  • Ensure cache keys reflect the normalized ordering parameters so cached results match the actual SQL ordering.

Description

  • Normalize and validate orderBy and orderWay inputs inside getBestSellingProductIds, getBestSellingProductIdsByBrand, getBestSellingProductIdsByFeature and getBestSellingProductIdsByFeatureValue by mapping allowed names to explicit SQL columns via an $allowedOrderBy map and deriving $orderColumn.
  • Force orderWay to an uppercase ASC/DESC fallback and use pSQL($orderColumn) and pSQL($orderWay) in the generated SQL ORDER BY to avoid injection/invalid identifiers.
  • Update cache keys to include the normalized $orderColumn instead of the raw orderBy string so cached entries correspond to the actual SQL ordering.

Testing

  • No automated tests were executed for this change.

Codex Task

@CySSoO CySSoO merged commit edcad5e into master Feb 3, 2026
2 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant