foreach ( $add as $col => $def ) {
if ( ! in_array( $col, (array) $cols, true ) ) {
// One-time schema migration — ALTER TABLE is intentional.
// $col is an allowlisted key from our own $add array (never user input).
// $def is a hardcoded string literal (never user input).
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
$wpdb->query(
$wpdb->prepare(
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
'ALTER TABLE %i ADD COLUMN ' . $col . ' ' . $def,
$table
)
);
}
}
