PHPCS ignore comments

wpovernight · Jan 24, 2025 · 721fbee · 721fbee
1 parent 1efd681
commit 721fbee
Show file tree

Hide file tree

Showing 11 changed files with 156 additions and 34 deletions.
diff --git a/includes/Admin.php b/includes/Admin.php
@@ -197,7 +197,14 @@ public function setup_wizard() {
 
 	public function get_invoice_count() {
 		global $wpdb;
-		$invoice_count = $wpdb->get_var( $wpdb->prepare( "SELECT count(*)  FROM {$wpdb->postmeta} WHERE meta_key = %s", '_wcpdf_invoice_number' ) );
+
+		$invoice_count = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"SELECT count(*) FROM {$wpdb->postmeta} WHERE meta_key = %s",
+				'_wcpdf_invoice_number'
+			)
+		);
+
 		return (int) $invoice_count;
 	}
 

diff --git a/includes/Documents/OrderDocument.php b/includes/Documents/OrderDocument.php
@@ -1796,9 +1796,14 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		$current_year_table_name = "{$default_table_name}_{$current_year}";
 
 		// first, remove last year if it already exists
-		$retired_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $retired_table_name ) . "'" ) == $retired_table_name;
+		$retired_exists = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW TABLES LIKE '" . esc_sql( $retired_table_name ) . "'"
+		) == $retired_table_name;
+
 		if ( $retired_exists ) {
-			$table_removed = $wpdb->query( "DROP TABLE IF EXISTS `" . esc_sql( $retired_table_name ) . "`" );
+			$table_removed = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				"DROP TABLE IF EXISTS `" . esc_sql( $retired_table_name ) . "`" // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+			);
 
 			if( ! $table_removed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to remove the duplicate number store %s: %s', $retired_table_name, $wpdb->last_error ) );
@@ -1807,9 +1812,14 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		}
 
 		// rename current to last year
-		$default_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $default_table_name ) . "'" ) == $default_table_name;
+		$default_exists = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW TABLES LIKE '" . esc_sql( $default_table_name ) . "'"
+		) == $default_table_name;
+
 		if ( $default_exists ) {
-			$table_renamed = $wpdb->query( "ALTER TABLE `" . esc_sql( $default_table_name ) . "` RENAME `" . esc_sql( $retired_table_name ) . "`" );
+			$table_renamed = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				"ALTER TABLE `" . esc_sql( $default_table_name ) . "` RENAME `" . esc_sql( $retired_table_name ) . "`" // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+			);
 
 			if( ! $table_renamed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to rename the number store from %s to %s: %s', $default_table_name, $retired_table_name, $wpdb->last_error ) );
@@ -1818,9 +1828,14 @@ public function maybe_retire_number_store( $date, $store_base_name, $method ) {
 		}
 
 		// if the current year table name already exists (created earlier as a 'future' year), rename that to default
-		$current_year_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $current_year_table_name ) . "'" ) == $current_year_table_name;
+		$current_year_exists = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW TABLES LIKE '" . esc_sql( $current_year_table_name ) . "'"
+		) == $current_year_table_name;
+
 		if ( $current_year_exists ) {
-			$table_renamed = $wpdb->query( "ALTER TABLE `" . esc_sql( $current_year_table_name ) . "` RENAME `" . esc_sql( $default_table_name ) . "`" );
+			$table_renamed = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				"ALTER TABLE `" . esc_sql( $current_year_table_name ) . "` RENAME `" . esc_sql( $default_table_name ) . "`" // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+			);
 
 			if( ! $table_renamed ) {
 				wcpdf_log_error( sprintf( 'An error occurred while trying to rename the number store from %s to %s: %s', $current_year_table_name, $default_table_name, $wpdb->last_error ) );
@@ -1854,10 +1869,15 @@ public function get_number_store_year( $table_name ) {
 			$current_year = intval( $next_year->date_i18n( 'Y' ) );
 		}
 
-		$table_exists = $wpdb->get_var( "SHOW TABLES LIKE '" . esc_sql( $table_name ) . "'" ) == $table_name;
+		$table_exists = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW TABLES LIKE '" . esc_sql( $table_name ) . "'"
+		) == $table_name;
+
 		if ( $table_exists ) {
 			// get year for the last row
-			$year = $wpdb->get_var( "SELECT YEAR(date) FROM `" . esc_sql( $table_name ) . "` ORDER BY id DESC LIMIT 1" );
+			$year = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				"SELECT YEAR(date) FROM `" . esc_sql( $table_name ) . "` ORDER BY id DESC LIMIT 1"
+			);
 			// default to current year if no results
 			if ( ! $year ) {
 				$year = $current_year;

diff --git a/includes/Documents/OrderDocumentMethods.php b/includes/Documents/OrderDocumentMethods.php
@@ -767,15 +767,22 @@ public function calculate_tax_rate( $price_ex_tax, $tax ) {
 	 */
 	public function get_tax_rate_by_id( $rate_id, $order = null ) {
 		global $wpdb;
+
 		// WC 3.7+ stores rate in tax items!
 		if ( $order_rates = $this->get_tax_rates_from_order( $order ) ) {
 			if ( isset( $order_rates[ $rate_id ] ) ) {
 				return (float) $order_rates[ $rate_id ];
 			}
 		}
 
-		$rate = $wpdb->get_var( $wpdb->prepare( "SELECT tax_rate FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_id = %d;", $rate_id ) );
-		if ($rate === NULL) {
+		$rate = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"SELECT tax_rate FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_id = %d;",
+				$rate_id
+			)
+		);
+
+		if ( is_null( $rate ) ) {
 			return false;
 		} else {
 			return (float) $rate;
@@ -819,7 +826,9 @@ public function get_tax_rates_from_order( $order ) {
 	 */
 	public function get_tax_rate_ids() {
 		global $wpdb;
-		$rates = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates" );
+		$rates = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates"
+		);
 
 		$tax_rate_ids = array();
 		foreach ($rates as $rate) {

diff --git a/includes/Documents/SequentialNumberStore.php b/includes/Documents/SequentialNumberStore.php
@@ -159,7 +159,12 @@ public function set_next( $number = 1 ) {
 			// if AUTO_INCREMENT is not 1, we need to make sure we have a 'highest value' in case of server restarts
 			// https://serverfault.com/questions/228690/mysql-auto-increment-fields-resets-by-itself
 			$highest_number = (int) $number - 1;
-			$wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", $highest_number ) );
+			$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$wpdb->prepare(
+					"ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+					$highest_number
+				)
+			);
 			$data = array(
 				'order_id' => 0,
 				'date'     => get_date_from_gmt( gmdate( 'Y-m-d H:i:s' ) ),
@@ -170,10 +175,18 @@ public function set_next( $number = 1 ) {
 			}
 
 			// after this insert, AUTO_INCREMENT will be equal to $number
-			$wpdb->insert( $table_name, $data );
+			$wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$table_name,
+				$data
+			);
 		} else {
 			// simple scenario, no need to insert any rows
-			$wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", $number ) );
+			$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$wpdb->prepare(
+					"ALTER TABLE `" . esc_sql( $table_name ) . "` AUTO_INCREMENT=%d;", // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+					$number
+				)
+			);
 		}
 	}
 

diff --git a/includes/Install.php b/includes/Install.php
@@ -393,7 +393,9 @@ protected function upgrade( $installed_version ) {
 				$store_name        = "{$document->slug}_number";
 				$method            = WPO_WCPDF()->settings->get_sequential_number_store_method();
 				$table_name        = apply_filters( 'wpo_wcpdf_number_store_table_name', sanitize_key( "{$wpdb->prefix}wcpdf_{$store_name}" ), $store_name, $method );
-				$table_name_exists = $wpdb->get_var( $wpdb->prepare( "SHOW TABLES LIKE %s", esc_sql( $table_name ) ) ) === $table_name;
+				$table_name_exists = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+					$wpdb->prepare( "SHOW TABLES LIKE %s", esc_sql( $table_name ) )
+				) === $table_name;
 
 				if ( ! $table_name_exists ) {
 					continue;
@@ -406,7 +408,12 @@ protected function upgrade( $installed_version ) {
 						$column_name      = 'date';
 						$table_name_safe  = sanitize_key( $number_store->table_name );
 						$column_name_safe = sanitize_key( $column_name );					
-						$query_result     = $wpdb->query( $wpdb->prepare( "ALTER TABLE `" . esc_sql( $table_name_safe ) . "` ALTER `" . esc_sql( $column_name_safe ) . "` SET DEFAULT %s", '1000-01-01 00:00:00' ) );
+						$query_result     = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+							$wpdb->prepare(
+								"ALTER TABLE `" . esc_sql( $table_name_safe ) . "` ALTER `" . esc_sql( $column_name_safe ) . "` SET DEFAULT %s", // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange
+								'1000-01-01 00:00:00'
+							)
+						);
 
 						if ( $query_result ) {
 							wcpdf_log_error(

diff --git a/includes/Main.php b/includes/Main.php
@@ -1249,10 +1249,17 @@ public function remove_order_personal_data( $order ) {
 		global $wpdb;
 		// remove order ID from number stores
 		$number_stores = apply_filters( "wpo_wcpdf_privacy_number_stores", array( 'invoice_number' ) );
+
 		foreach ( $number_stores as $store_name ) {
-			$order_id = $order->get_id();
+			$order_id   = $order->get_id();
 			$table_name = apply_filters( "wpo_wcpdf_number_store_table_name", "{$wpdb->prefix}wcpdf_{$store_name}", $store_name, 'auto_increment' ); // i.e. wp_wcpdf_invoice_number
-			$wpdb->query( $wpdb->prepare( "UPDATE " . esc_sql( $table_name ) . " SET order_id = 0 WHERE order_id = %s", $order_id ) );
+
+			$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$wpdb->prepare(
+					"UPDATE " . esc_sql( $table_name ) . " SET order_id = 0 WHERE order_id = %s",
+					$order_id
+				)
+			);
 		}
 	}
 

diff --git a/includes/Semaphore.php b/includes/Semaphore.php
@@ -99,15 +99,25 @@ private function ensure_database_initialised(): int {
 		global $wpdb;
 
 		// Check if the lock option already exists
-		$existing_option = $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s", $this->option_name ) );
+		$existing_option = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s",
+				$this->option_name
+			)
+		);
 
 		if ( 1 === (int) $existing_option ) {
 			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') already existed in the database', 'debug' );
 			return 1;
 		}
 
 		// Insert the lock option with a default value of 0
-		$rows_affected = $wpdb->query( $wpdb->prepare( "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, '0', 'no')", $this->option_name ) );
+		$rows_affected = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, '0', 'no')",
+				$this->option_name
+			)
+		);
 
 		if ( $rows_affected > 0 ) {
 			$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') was created in the database', 'debug' );
@@ -135,7 +145,14 @@ public function lock( int $retries = 0 ): bool {
 		$time_now      = time();
 		$retries       = $retries > 0 ? $retries : $this->retries;
 		$acquire_until = $time_now + $this->locked_for;
-		$query         = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now ) );
+		$query         = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d",
+				$acquire_until,
+				$this->option_name,
+				$time_now
+			)
+		);
 
 		if ( 1 === $query ) {
 			$this->log( 'Lock (' . $this->option_name . ', ' . $wpdb->options . ') acquired', 'info' );
@@ -149,7 +166,14 @@ public function lock( int $retries = 0 ): bool {
 		}
 
 		do {
-			$query = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now ) );
+			$query = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+				$wpdb->prepare(
+					"UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d",
+					$acquire_until,
+					$this->option_name,
+					$time_now
+				)
+			);
 
 			// Now that the row has been created, try again
 			if ( 1 === $query ) {
@@ -166,7 +190,12 @@ public function lock( int $retries = 0 ): bool {
 				// As a second has passed, update the time we are aiming for
 				$time_now = time();
 				$acquire_until = $time_now + $this->locked_for;
-				$sql = $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d", $acquire_until, $this->option_name, $time_now );
+				$sql = $wpdb->prepare(
+					"UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value < %d",
+					$acquire_until,
+					$this->option_name,
+					$time_now
+				);
 			}
 		} while ( $retries >= 0 );
 
@@ -191,7 +220,12 @@ public function release(): bool {
 
 		$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') released', 'info' );
 
-		$result = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = '0' WHERE option_name = %s", $this->option_name ) ) === 1;
+		$result = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"UPDATE {$wpdb->options} SET option_value = '0' WHERE option_name = %s",
+				$this->option_name
+			)
+		) === 1;
 
 		$this->acquired = false;
 
@@ -208,7 +242,12 @@ public function delete(): void {
 		$this->acquired = false;
 
 		global $wpdb;
-		$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name = %s", $this->option_name ) );
+		$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"DELETE FROM {$wpdb->options} WHERE option_name = %s",
+				$this->option_name
+			)
+		);
 
 		$this->log( 'Lock option (' . $this->option_name . ', ' . $wpdb->options . ') was deleted from the database' );
 	}
@@ -281,7 +320,7 @@ public static function cleanup_released_locks( bool $legacy = false ): void {
 
 		$option_prefix = $legacy ? self::$legacy_option_prefix : self::$option_prefix;
 
-		$wpdb->query(
+		$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
 			$wpdb->prepare(
 				"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s AND option_value = '0'",
 				$wpdb->esc_like( $option_prefix ) . '%'
@@ -301,7 +340,7 @@ public static function count_released_locks( bool $legacy = false ): int {
 
 		$option_prefix = $legacy ? self::$legacy_option_prefix : self::$option_prefix;
 
-		$count = (int) $wpdb->get_var(
+		$count = (int) $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
 			$wpdb->prepare(
 				"SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name LIKE %s AND option_value = '0'",
 				$wpdb->esc_like( $option_prefix ) . '%'

diff --git a/includes/Settings.php b/includes/Settings.php
@@ -785,7 +785,10 @@ public function get_sequential_number_store_method() {
 		$method = isset( $this->debug_settings['calculate_document_numbers'] ) ? 'calculate' : 'auto_increment';
 
 		// safety first - always use calculate when auto_increment_increment is not 1
-		$row = $wpdb->get_row("SHOW VARIABLES LIKE 'auto_increment_increment'");
+		$row = $wpdb->get_row( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW VARIABLES LIKE 'auto_increment_increment'"
+		);
+
 		if ( ! empty( $row ) && ! empty( $row->Value ) && $row->Value != 1 ) {
 			$method = 'calculate';
 		}

diff --git a/includes/Settings/SettingsDebug.php b/includes/Settings/SettingsDebug.php
@@ -136,7 +136,10 @@ public function display_numbers( $nonce ) {
 	public function get_number_store_tables() {
 		global $wpdb;
 
-		$tables          = $wpdb->get_results( "SHOW TABLES LIKE '{$wpdb->prefix}wcpdf_%'" );
+		$tables = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			"SHOW TABLES LIKE '{$wpdb->prefix}wcpdf_%'"
+		);
+
 		$document_titles = WPO_WCPDF()->documents->get_document_titles();
 		$table_names     = array();
 

diff --git a/includes/Tables/NumberStoreListTable.php b/includes/Tables/NumberStoreListTable.php
@@ -224,15 +224,17 @@ public function get_numbers() {
 
 		if ( ! empty( $table_name ) ) {
 			if ( $search ) {
-				$results = $wpdb->get_results( 
+				$results = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
 					$wpdb->prepare(
 						"SELECT * FROM `" . esc_sql( $table_name ) . "` WHERE `id` = %d OR `order_id` = %d ORDER BY " . esc_sql( $orderby ) . " " . esc_sql( $order ), 
 						$search, 
 						$search 
 					) 
 				);										
 			} else {
-				$results = $wpdb->get_results( "SELECT * FROM `" . esc_sql( $table_name ) . "` ORDER BY `" . esc_sql( $orderby ) . "` " . esc_sql( $order ) );
+				$results = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+					"SELECT * FROM `" . esc_sql( $table_name ) . "` ORDER BY `" . esc_sql( $orderby ) . "` " . esc_sql( $order )
+				);
 			}
 		}
 

diff --git a/ubl/Settings/TaxesSettings.php b/ubl/Settings/TaxesSettings.php
@@ -39,7 +39,14 @@ public function output() {
 
 	public function output_table_for_tax_class( $slug, $name ) {
 		global $wpdb;
-		$results      = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_class = %s;", ( $slug == 'standard' ) ? '' : $slug ) );
+
+		$results = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+			$wpdb->prepare(
+				"SELECT * FROM {$wpdb->prefix}woocommerce_tax_rates WHERE tax_rate_class = %s;",
+				( $slug == 'standard' ) ? '' : $slug
+			)
+		);
+
 		$allowed_html = array(
 			'select' => array(
 				'name'         => true,
@@ -74,7 +81,12 @@ public function output_table_for_tax_class( $slug, $name ) {
 				<?php
 					if ( ! empty( $results ) ) {
 						foreach ( $results as $result ) {
-							$locationResults = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_tax_rate_locations WHERE tax_rate_id = %d;", $result->tax_rate_id ) );
+							$locationResults = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery
+								$wpdb->prepare(
+									"SELECT * FROM {$wpdb->prefix}woocommerce_tax_rate_locations WHERE tax_rate_id = %d;",
+									$result->tax_rate_id
+								)
+							);
 							$postcode        = array();
 							$city            = array();