prepare(), with %i for table names and %s/%d/%f for values, so nothing is ever interpolated into SQL. /** * Resolves the commission rate for an order. * * A per affiliate override wins, otherwise the store wide default applies. * The ppl_afw_resolved_rate filter can insert more specific rates. */ class Rate_Resolver { /** * Settings. * * @var Settings */ private $settings; /** * Constructor. * * @param Settings $settings Settings service. */ public function __construct( Settings $settings ) { $this->settings = $settings; } /** * Resolves the rate for an affiliate, product, and purchase number. * * @since 1.0.0 * @param object $affiliate Affiliate row. * @param int $product_id Product id, 0 for an order level rate (shipping). * @param int $purchase_number 1-based number of this customer's paid purchases, this one included. * @param \WC_Order_Item_Product|null $item The line item the rate is for, when there is one. * @return array{type: string, value: float, source: string} */ public function resolve( $affiliate, $product_id, $purchase_number = 1, $item = null ) { $rate = null; // A per affiliate rate override beats the store wide default. if ( '' !== $affiliate->rate_type && $affiliate->rate_value > 0 ) { $rate = array( 'type' => $affiliate->rate_type, 'value' => (float) $affiliate->rate_value, 'source' => 'affiliate', ); } if ( ! $rate ) { $rate = array( 'type' => (string) $this->settings->get( 'rate_type' ), 'value' => (float) $this->settings->get( 'rate_value' ), 'source' => 'global', ); } /** * Filters the resolved commission rate. * * Runs once per line item, and once with product id 0 for shipping. * * @since 1.0.0 * @since 1.3.0 The line item is passed. * @param array $rate type, value, source. * @param object $affiliate Affiliate row. * @param int $product_id Product id. * @param int $purchase_number Customer purchase number. * @param \WC_Order_Item_Product|null $item Line item, or null. */ return apply_filters( 'ppl_afw_resolved_rate', $rate, $affiliate, $product_id, $purchase_number, $item ); } /** * Computes the commission amount from a base and a rate. * * @since 1.0.0 * @param float $base Base amount. * @param array $rate type, value. * @return float */ public function calculate( $base, array $rate ) { if ( 'flat' === $rate['type'] ) { return round( (float) $rate['value'], 4 ); } return round( $base * (float) $rate['value'] / 100, 4 ); } }