Introduce wp db users command for user management by Copilot · Pull Request #303 · wp-cli/db-command

Copilot · 2026-01-19T10:26:34Z

Implementation Plan

Summary

Implemented wp db users create command that allows database administrators to easily create MySQL user accounts with optional privileges on the WordPress database. The implementation extends DB_Command for consistency, follows WP-CLI patterns, and includes comprehensive tests. Latest changes remove redundant @var annotations as requested, using explicit type casting with PHPStan ignore comments where needed for the conditional return type from the parent method.

Original prompt

This section details on the original issue you should resolve

<issue_title>Introduce wp db users</issue_title>
<issue_description>One of the most common tasks database administrators need to do is create user accounts for applications with full privileges to the application's database. I propose that we make that super simple in wp-cli using syntax similar to:

wp db users create --user --host --pass --privilegeduser --privilegedpass

Name of the database user to create.
Hosts that are permitted to connect as .
New user's password.
Database user with sufficient privileges to execute the command.
Privileged user's password.

This create command could be augmented by including list, delete, etc.</issue_description>

Comments on the Issue (you are @copilot in this section)
@danielbachhuber I'm open to considering something like this, if someone would like to open a pull request for it.

Fixes Introduce wp db users #138

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

codecov · 2026-01-19T11:37:30Z

Codecov Report

❌ Patch coverage is 93.33333% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
db-command.php	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

…utput.txt Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-17T20:54:41Z

+		// Escape identifiers for SQL
+		// @phpstan-ignore cast.string (PHPStan doesn't infer conditional return type from parent method)
+		$username_escaped = (string) self::esc_sql_ident( $username );
+		// @phpstan-ignore cast.string (PHPStan doesn't infer conditional return type from parent method)
+		$host_escaped    = (string) self::esc_sql_ident( $host );
+		$user_identifier = $username_escaped . '@' . $host_escaped;


esc_sql_ident() backticks identifiers (e.g., user), but MySQL account names in CREATE USER / GRANT ... TO syntax need to be string-literal quoted (e.g., 'user'@'host'). Using backticks here will fail for common hosts like % and may produce invalid SQL. Consider escaping username/host as SQL string literals (and building 'user'@'host') rather than using identifier escaping.

Suggested change

// Escape identifiers for SQL

// @phpstan-ignore cast.string (PHPStan doesn't infer conditional return type from parent method)

$username_escaped = (string) self::esc_sql_ident( $username );

// @phpstan-ignore cast.string (PHPStan doesn't infer conditional return type from parent method)

$host_escaped = (string) self::esc_sql_ident( $host );

$user_identifier = $username_escaped . '@' . $host_escaped;

// MySQL account names in CREATE USER / GRANT ... TO use string literals, not identifiers.

$username_escaped = $this->esc_sql_string( $username );

$host_escaped = $this->esc_sql_string( $host );

$user_identifier = $username_escaped . '@' . $host_escaped;

Copilot · 2026-04-17T20:54:41Z

+	 * Follows MySQL's documented string literal escaping rules.
+	 * See https://dev.mysql.com/doc/refman/en/string-literals.html
+	 *
+	 * @param string $value String to escape.
+	 * @return string Escaped string, wrapped in single quotes.
+	 */
+	private function esc_sql_string( $value ) {
+		// Escape special characters according to MySQL string literal rules.
+		$value = str_replace(
+			[ '\\', "\x00", "\n", "\r", "'", '"', "\x1a" ],
+			[ '\\\\', "\\0", "\\n", "\\r", "\\'", '\\"', '\\Z' ],
+			$value
+		);
+		return "'" . $value . "'";


esc_sql_string() relies on backslash escapes for quotes (e.g., \'). This will break (and can become unsafe) when the server/session has NO_BACKSLASH_ESCAPES enabled, because backslashes no longer escape quotes. Since run_query() doesn't remove that SQL mode, consider escaping single quotes by doubling them (' → '') or explicitly handling NO_BACKSLASH_ESCAPES when building the IDENTIFIED BY literal.

Suggested change

* Follows MySQL's documented string literal escaping rules.

* See https://dev.mysql.com/doc/refman/en/string-literals.html

*

* @param string $value String to escape.

* @return string Escaped string, wrapped in single quotes.

*/

private function esc_sql_string( $value ) {

// Escape special characters according to MySQL string literal rules.

$value = str_replace(

[ '\\', "\x00", "\n", "\r", "'", '"', "\x1a" ],

[ '\\\\', "\\0", "\\n", "\\r", "\\'", '\\"', '\\Z' ],

$value

);

return "'" . $value . "'";

* Uses SQL-standard single-quote escaping (`'` => `''`) so the generated

* literal remains valid even when MySQL is running with

* `NO_BACKSLASH_ESCAPES`.

*

* @param string $value String to escape.

* @return string Escaped string, wrapped in single quotes.

*/

private function esc_sql_string( $value ) {

return "'" . str_replace( "'", "''", $value ) . "'";

Copilot · 2026-04-17T20:54:42Z

+ *
+ *     # Create a new database user with privileges.
+ *     $ wp db users create myuser myhost --password=mypass --grant-privileges
+ *     Success: Database user 'myuser'@'myhost' created with privileges.


The class-level example output says the user is "created with privileges", but the implementation prints "created with privileges on database '...'." Updating the example output will keep docs consistent with the actual command behavior.

Suggested change

* Success: Database user 'myuser'@'myhost' created with privileges.

* Success: Database user 'myuser'@'myhost' created with privileges on database 'wp_database'.

Copilot · 2026-04-17T20:54:42Z

+    When I try `wp db create`
+    And I run `wp db users create testuser localhost --password=testpass123`


The scenarios use When I try wp db create but never assert the return code or output. If `wp db create` fails, the rest of the scenario can still pass because creating a MySQL user (and querying `mysql.user`) doesn’t require the WordPress DB to exist. Use `When I run `wp db create (or assert a 0 return code) to make the tests actually validate database creation.

Initial plan

2e544c4

Copilot AI assigned Copilot and swissspidy Jan 19, 2026

Copilot started work on behalf of swissspidy January 19, 2026 10:34 View session

Copilot AI requested a review from swissspidy January 19, 2026 10:36

github-actions bot added command:db scope:distribution state:unconfirmed command:db-users labels Jan 19, 2026

This comment was marked as resolved.

Sign in to view

Copilot started work on behalf of swissspidy January 19, 2026 13:06 View session

Copilot AI and others added 3 commits January 19, 2026 13:15

Add wp db users create command implementation

347182e

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Refactor DB_Users_Command to extend DB_Command and improve security

891f713

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Simplify code by calling parent::run_query directly and remove test-o…

7f2d7d9

…utput.txt Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

This comment was marked as resolved.

Sign in to view

Copilot AI changed the title ~~[WIP] Introduce wp db users command for user management~~ Introduce wp db users command for user management Jan 19, 2026

Copilot finished work on behalf of swissspidy January 19, 2026 13:59

swissspidy reviewed Jan 19, 2026

View reviewed changes

Comment thread src/DB_Users_Command.php Outdated

Copilot started work on behalf of swissspidy January 19, 2026 15:12 View session

Make esc_sql_ident protected in parent class and call it statically

84b425f

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Copilot AI requested a review from swissspidy January 19, 2026 15:15

Copilot finished work on behalf of swissspidy January 19, 2026 15:15

swissspidy requested a review from Copilot January 19, 2026 16:09

Copilot started reviewing on behalf of swissspidy January 19, 2026 16:09 View session

This comment was marked as resolved.

Sign in to view

Copilot started work on behalf of swissspidy January 19, 2026 16:16 View session

Remove assert calls and improve SQL string escaping for security

421a9a4

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Copilot finished work on behalf of swissspidy January 19, 2026 16:26

This comment was marked as resolved.

Sign in to view

Merge branch 'main' into copilot/add-wp-db-users-command

db8bebf

swissspidy reviewed Mar 11, 2026

View reviewed changes

Comment thread src/DB_Users_Command.php Outdated

swissspidy added this to the 2.1.5 milestone Mar 11, 2026

Copilot started work on behalf of swissspidy March 11, 2026 17:11 View session

Remove redundant @var annotations and use explicit type casting

c57a6c6

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Copilot AI requested a review from swissspidy March 11, 2026 17:16

Copilot finished work on behalf of swissspidy March 11, 2026 17:16

Merge branch 'main' into copilot/add-wp-db-users-command

06044eb

swissspidy marked this pull request as ready for review March 11, 2026 21:40

swissspidy requested a review from a team as a code owner March 11, 2026 21:40

swissspidy modified the milestones: 2.1.5, 2.1.6 Mar 17, 2026

Merge branch 'main' into copilot/add-wp-db-users-command

f291b1e

wojsmol reviewed Mar 22, 2026

View reviewed changes

Comment thread phpcs.xml.dist Outdated

swissspidy added 4 commits April 6, 2026 22:19

Merge branch 'main' into copilot/add-wp-db-users-command

6bfaf43

Merge branch 'main' into copilot/add-wp-db-users-command

719cb77

Namespaces, tests

36fb7e1

Lint fix

fcb2d05

swissspidy requested a review from Copilot April 17, 2026 20:50

Copilot started reviewing on behalf of swissspidy April 17, 2026 20:50 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce wp db users command for user management#303

Introduce wp db users command for user management#303
Copilot wants to merge 14 commits intomainfrom
copilot/add-wp-db-users-command

Copilot AI commented Jan 19, 2026 •

edited

Loading

Uh oh!

codecov bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	* Success: Database user 'myuser'@'myhost' created with privileges.
	* Success: Database user 'myuser'@'myhost' created with privileges on database 'wp_database'.

		When I try `wp db create`
		And I run `wp db users create testuser localhost --password=testpass123`

Conversation

Copilot AI commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Plan

Summary

Comments on the Issue (you are @copilot in this section)

Uh oh!

codecov bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jan 19, 2026 •

edited

Loading

codecov bot commented Jan 19, 2026 •

edited

Loading