Fix: Form Entries

[n7studios]

Summary

Fixes several issues with Form Entries (Settings > Kit > Form Entries), and the ConvertKit_Form_Entries class:

• Table not created on WordPress 5.6 – 6.1. Queries used the %i identifier placeholder, which $wpdb->prepare() only supports from WordPress 6.2. The Plugin requires WordPress 5.6, so on older versions the CREATE TABLE query failed and Form Builder entries were never stored. The 3.0.4 upgrade routine that adds the form_id column had the same issue. The table name is now interpolated from $wpdb->prefix instead, matching get_by_ids() and delete_by_ids().
• CSV export broke with custom fields, quotes or commas. Values weren't escaped, so custom fields (stored as JSON) or any value containing a double quote corrupted the row. Double quotes are now escaped.
• CSV formula injection. Entries are submitted by site visitors, and values starting with =, +, -, @, tab or carriage return were exported as-is, so spreadsheet applications would run them as formulas. These values are now prefixed with ' so they're treated as text.
• update() returned the wrong ID. It returned $wpdb->insert_id (0, or the last inserted entry's ID), so upsert() returned the wrong ID for existing entries. It now returns the entry's ID.
• Search treated % and _ as wildcards. Search terms are now escaped with $wpdb->esc_like().
• Invalid orderby caused a database error. search() now only orders by a known column, falling back to created_at.
• delete_by_ids() with no IDs ran an invalid IN () query. It now returns early.
• Bulk actions check current_user_can( 'manage_options' ), and the export is sent as text/csv; charset=utf-8 instead of application/x-msdownload.

Testing

New Integration tests in FormEntriesTest, which fail on main and pass with this PR:

• testUpdateEntryReturnsEntryID
• testUpsertExistingEntryReturnsEntryID
• testDeleteEntriesWithNoIDs
• testSearchWithWildcardCharacters
• testSearchWithInvalidOrderBy
• testGetCSVStringEscapesDoubleQuotes
• testGetCSVStringEscapesFormulas

Existing FormEntriesTest and PluginSettingsFormEntriesCest tests pass unchanged.

For the %i change, FormEntriesTest was also run against WordPress 6.1.7. It fails on main (the table isn't created) and passes with this PR. A one-off check confirmed the 3.0.4 upgrade routine now adds the form_id column on 6.1.7. CI only tests the latest WordPress version, so neither check is included as an automated test.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground