0

I've inherited an old WordPress site that my customer doesn't want to be rebuilt. It has an old MySQL query in the functions.php of the theme that is supposed to put a category image with the category. Over time of course, WordPress has been updated and the query doesn't work any more. I'm hoping someone can help advise how I can update this. The code is:

function catImg($catId){

$data = mysql_fetch_object(mysql_query('SELECT * FROM `wp_ig_caticons` WHERE `cat_id` = "'. $catId .'"'));

if($data->icon){
echo '<img height="158" width="121" title="" alt="skyway" class="attachment-post-thumbnail wp-post-image" src="'. site_url() .'/'. $data->icon .'"/>';
}
else{
echo '<img height="158" width="121" alt="no-image" class="attachment-post-thumbnail wp-post-image" src="'. site_url() .'/wp-content/themes/sky-way/images/no-image.jpg"/>';
}
}

Thank you in advance

2

mysql_fetch_object() was deprecated in PHP 5.5 and fully removed in PHP 7.0, which is probably why it no longer works for you. It's always better to use WP functions - often they are wrappers for something in PHP (or elsewhere), but by using the WP wrapper version, it usually protects you from deprecation (since the WP method can be updated to accommodate the new scripting language changes) - that way your core code wouldn't need to change.

Try using the $wpdb->get_row(). It's pretty much the same as what you have, but more "WordPressy":

function catImg( $catId ){

    global $wpdb;

    $data = $wpdb->get_row( $wpdb->prepare( 'SELECT * FROM `' . $wpdb->prefix . 'ig_caticons` WHERE `cat_id` =  %d', absint( $catId ) ) );

    if ( $data->icon ) {
        echo '<img height="158" width="121" title="" alt="skyway" class="attachment-post-thumbnail wp-post-image" src="'. esc_url( site_url( esc_attr( $data->icon ) ) ) . '"/>';
    } else {
        echo '<img height="158" width="121" alt="no-image" class="attachment-post-thumbnail wp-post-image" src="'. site_url( '/wp-content/themes/sky-way/images/no-image.jpg' ) . '"/>';
    }
}
| improve this answer | |
  • Good to know about the deprecation. ps: we should prepare the SQL query to avoid possible injections. We could also escape the value for the src attribute as it's being displayed. Better safe than sorry :-) We don't need to fetch all fields, since only the icon is used within the function. – birgire Dec 29 '18 at 22:36
  • Sure, if we're going to bother, then we should also use site_url() properly, too, and escape the URL to make sure it's valid, since I have know idea what the data coming out could be. I'd probably disagree on the all fields, though unless I knew more about the data row. It's only a single row, and while writing is expensive, reading is cheap. Yes it's only using the one field, but who knows - that may change (but if he wants to change that, he can). – butlerblog Dec 30 '18 at 0:25
  • Thanks for the update (yebb, I had esc_url in mind for src) – birgire Dec 30 '18 at 0:39
  • ps: just stumbled up on an interesting story, added yesterday on dev.to, that's related to select *. – birgire Dec 30 '18 at 9:03
  • Sorry it's taken me a while to come back. Just wanted to update you that this code worked, so thank you very much. – fuzball1st Feb 4 '19 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.