0

I've inherited an old WordPress site that my customer doesn't want to be rebuilt. It has an old MySQL query in the functions.php of the theme that is supposed to put a category image with the category. Over time of course, WordPress has been updated and the query doesn't work any more. I'm hoping someone can help advise how I can update this. The code is:

function catImg($catId){

$data = mysql_fetch_object(mysql_query('SELECT * FROM `wp_ig_caticons` WHERE `cat_id` = "'. $catId .'"'));

if($data->icon){
echo '<img height="158" width="121" title="" alt="skyway" class="attachment-post-thumbnail wp-post-image" src="'. site_url() .'/'. $data->icon .'"/>';
}
else{
echo '<img height="158" width="121" alt="no-image" class="attachment-post-thumbnail wp-post-image" src="'. site_url() .'/wp-content/themes/sky-way/images/no-image.jpg"/>';
}
}

Thank you in advance

1 Answer 1

2

mysql_fetch_object() was deprecated in PHP 5.5 and fully removed in PHP 7.0, which is probably why it no longer works for you. It's always better to use WP functions - often they are wrappers for something in PHP (or elsewhere), but by using the WP wrapper version, it usually protects you from deprecation (since the WP method can be updated to accommodate the new scripting language changes) - that way your core code wouldn't need to change.

Try using the $wpdb->get_row(). It's pretty much the same as what you have, but more "WordPressy":

function catImg( $catId ){

    global $wpdb;

    $data = $wpdb->get_row( $wpdb->prepare( 'SELECT * FROM `' . $wpdb->prefix . 'ig_caticons` WHERE `cat_id` =  %d', absint( $catId ) ) );

    if ( $data->icon ) {
        echo '<img height="158" width="121" title="" alt="skyway" class="attachment-post-thumbnail wp-post-image" src="'. esc_url( site_url( esc_attr( $data->icon ) ) ) . '"/>';
    } else {
        echo '<img height="158" width="121" alt="no-image" class="attachment-post-thumbnail wp-post-image" src="'. site_url( '/wp-content/themes/sky-way/images/no-image.jpg' ) . '"/>';
    }
}
5
  • Good to know about the deprecation. ps: we should prepare the SQL query to avoid possible injections. We could also escape the value for the src attribute as it's being displayed. Better safe than sorry :-) We don't need to fetch all fields, since only the icon is used within the function.
    – birgire
    Commented Dec 29, 2018 at 22:36
  • Sure, if we're going to bother, then we should also use site_url() properly, too, and escape the URL to make sure it's valid, since I have know idea what the data coming out could be. I'd probably disagree on the all fields, though unless I knew more about the data row. It's only a single row, and while writing is expensive, reading is cheap. Yes it's only using the one field, but who knows - that may change (but if he wants to change that, he can).
    – butlerblog
    Commented Dec 30, 2018 at 0:25
  • Thanks for the update (yebb, I had esc_url in mind for src)
    – birgire
    Commented Dec 30, 2018 at 0:39
  • ps: just stumbled up on an interesting story, added yesterday on dev.to, that's related to select *.
    – birgire
    Commented Dec 30, 2018 at 9:03
  • Sorry it's taken me a while to come back. Just wanted to update you that this code worked, so thank you very much.
    – fuzball1st
    Commented Feb 4, 2019 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.