WP Manifestindependent plugin directory
manifest / integrations / google-spreadsheet-to-db

Google Spreadsheet to DB WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Integrates Google Sheets API to fetch data and store it in a WordPress database - An alternative to CSV Import

★ 7stars
14composer installs
v6.12.0latest · 8mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sectsect/google-spreadsheet-to-db/archive/refs/heads/master.zip

On Packagist as sectsect/google-spreadsheet-to-db:

composer require sectsect/google-spreadsheet-to-db
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Google Spreadsheet to DB

The "Google Spreadsheet to DB" plugin is designed for WordPress and facilitates the import of data from Google Sheets into a WordPress database using Google's Sheets API (v4). It supports data manipulation before saving and is configurable via a WordPress admin interface.

Features

  • Data Import: Pulls data from Google Sheets and saves it directly into the WordPress database.
  • Customization: Offers settings for defining constants, spreadsheet IDs, names, and configuring data formats.
  • Admin Interface: Provides an admin page for easy management and configuration of the plugin settings.

Requirements

  • PHP version 8.0 or higher.
  • Composer for managing PHP dependencies.

Get Started

1. Clone this Repo into your wp-content/plugins directory.
cd /path-to-your/wp-content/plugins/
git clone git@github.com:sectsect/google-spreadsheet-to-db.git
2. Remove vendor/ in .gitignore file.
cd google-spreadsheet-to-db
nano .gitignore
- vendor/
3. Install composer packages
cd functions/composer/
composer install
4. Activate the plugin through the 'Plugins' menu in WordPress.

Settings

Getting Your Spreadsheet Ready for Programmatic Access

By default, a new spreadsheet cannot be accessed via Google’s API. We’ll need to go to your Google APIs console and create a new project and set it up to expose your Spreadsheets’ data.

  1. Go to the Google APIs Console.
  2. Create a new project.
  3. Click Enable API. Search for and enable the Google Sheets API.
  4. Create credentials for a Web Server to access Application Data.
  5. Name the service account and grant it a Project Role of Editor.
  6. Download the JSON file.
  7. Copy the JSON file to your app directory and rename it to client_secret.json
  8. :warning: Set client_secret.json in a location to deny web access on your server.

We now have a big chunk of authentication information, including what Google calls a client_email, which uniquely represents this OAuth service account.
Grab the value of client_email from your client_secret.json, and head back to your spreadsheet. Click the Share button in the top right, and paste the client_email value into the field to give it edit rights.
Hit send. That’s it! :ok_hand:

  1. Set the define() constants for client_secret.json in wp-config.php.
    define( 'GOOGLE_SS2DB_CLIENT_SECRET_PATH', '/path/to/your/client_secret.json' );
  2. Go to Settings -> Google Spreadsheet to DB on your WordPress Admin-Panel.
  3. Set the following values and save it once.
  • Data format to be stored in database
    • json_encode
    • json_encode (JSON_UNESCAPED_UNICODE)
  1. Click the Import from Google Spreadsheet button. :tada:
  • Spreadsheet ID
  • Spreadsheet name (Optional)
  • Single Sheet name
  • Top Header Row
  • Title (Optional)

Filters

Filtering the Array

You can edit the array got from Google API with add_filter( 'google_ss2db_before_save', $function_to_add ) in your functions.php before saving to database.

add_filter( 'google_ss2db_before_save', function ( $row, $worksheet_id, $worksheet_name, $sheet_name ) {
  // Example
  if ( $worksheet_name === 'My Spreadsheet' && $sheet_name === 'Sheet1' ) {
    // Do something.

    return $something;
  }

  return $row;
}, 10, 3 );

And also use add_filter('google_ss2db_after_save', $return_array ) to perform any processing with the return value.

add_filter( 'google_ss2db_after_save', function ( $data ) {
  if ( 'My Spreadsheet' === $data['worksheet_name'] ) {
    // $id              = $data['id'];
    // $date            = $data['date'];
    // $title           = $data['title'];
    // $value           = $data['value'];
    // $work_sheet_id   = $data['worksheet_id'];
    // $work_sheet_name = $data['worksheet_name'];
    // $sheet_name      = $data['sheet_name'];
    // $result          = $data['result']; // `int|false` The number of rows inserted, or false on error.

    // Example
    my_callback( $data );
  }
});

APIs

new Google_Spreadsheet_To_DB_Query();

Parameters

Parameter Type Notes Default Value
where array array()
relation string AND or OR AND
[array] array
key string id or date or worksheet_id or worksheet_name or sheet_name or title false
value int e.g. 3 / 2020-09-01 12:00:00 false
compare string e.g. = > < >= <= <> != =
orderby string id or date or worksheet_id or worksheet_name or sheet_name or title date
order string DESC or ASC DESC
limit int number of row to get All Data
:memo: You can also use -1 to get all data.
offset int number of row to displace or pass over 0

Usage Example

Get all rows

$sheet = new Google_Spreadsheet_To_DB_Query();
$rows  = $sheet->getrow();
foreach ( $rows as $row ) {
  $id   = $row->id;
  $date = $row->date;
  $val  = json_decode( $row->value );
}

Get 3 rows from the 4th in ascending order by ID

$args = array(
  'orderby' => 'id',
  'order'   => 'ASC',
  'limit'   => 3,
  'offset'  => 3,
);
$sheet = new Google_Spreadsheet_To_DB_Query( $args );
$rows  = $sheet->getrow();
foreach ( $rows as $row ) {
  $id   = $row->id;
  $date = $row->date;
  $val  = json_decode( $row->value );
}

Get the row with specific ID

$args = array(
  'where' => array(
    array(
      'key'   => 'id',
      'value' => 3,
    )
  ),
);

Get 3 rows with specific Worksheet ordered by ID

$args = array(
  'orderby' => 'id',
  'order'   => 'ASC',
  'limit'   => 3,
  'where'   => array(
    array(
      'key'     => 'worksheet_name',
      'value'   => 'My Spreadsheet',
      'compare' => '='
    ),
  ),
);

Get the rows larger than or equal the specified datetime

$args = array(
  'where' => array(
    array(
      'key'     => 'date',
      'value'   => '2020-08-01 12:34:56',
      'compare' => '>=',
    )
  ),
);

Get the rows with multiple conditions

$args = array(
  'orderby' => 'id',
  'order'   => 'DESC',
  'limit'   => 10,
  'offset'  => 10,
  'where'   => array(
    'relation' => 'AND', // or 'OR'
    array(
      'key'     => 'date',
      'value'   => '2020-08-01 12:34:56',
      'compare' => '>='
    ),
    array(
      'key'     => 'worksheet_name',
      'value'   => 'My Spreadsheet',
      'compare' => '='
    ),
  ),
);

Notes

  • Tested on WordPress v6.3.1

For Developers

  • This plugin saves Spreadsheet's data to the global area, not to each post. If you want to have Spredsheet data for individual posts, you can link data ID with custom fields.

  • The data is added and stored in the wp_google_ss2db table as a JSON-encoded array.

    id date worksheet_id worksheet_name sheet_name title value
    1 2021-08-27 00:00:00 1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms My Spreadsheet Sheet1 Data-01 {"area":{"a":["brooklyn","bronx","Queens","Manhattan"],"b":["brooklyn","bronx","Queens","Manhattan"]}}
  • This Plugin does not hosting on the wordpress.org repo in order to prevent a flood of support requests from wide audience.

Debug Mode

To enable debug mode, add the following constant to your wp-config.php:

define( 'GOOGLE_SS2DB_DEBUG', true );

When debug mode is enabled, importing a spreadsheet will return a detailed JSON response instead of the usual redirect. The response includes the following information:

  • result: A boolean indicating the success or failure of the process
  • data: Details of the saved data
  • post_data: Sanitized post data
  • referer: The redirect URL

Note: Always set GOOGLE_SS2DB_DEBUG to false or remove the constant in production environments.

Troubleshooting

This plugin depends on Guzzle v7, which may conflict with other WordPress plugins or Composer packages using Guzzle v6.
If you encounter errors like:

Uncaught Error: Call to undefined method GuzzleHttp\Utils::chooseHandler()

This is likely due to a Guzzle version conflict. To resolve:

  1. Update other plugins/packages to versions compatible with Guzzle v7
  2. Find alternative solutions that don't conflict with this plugin's dependencies

Change log

See CHANGELOG file.

License

See LICENSE file.

✌️

A little project by @sectsect

Releases

Newest 25 of 47 recorded releases.

Tag
Published
v6.12.0 latest
Feb 20, 2026 8mo ago
Aug 24, 2025 1 year ago
Feb 9, 2025 1 year ago
Dec 13, 2024 1 year ago
Dec 13, 2024 1 year ago
Dec 13, 2024 1 year ago
Dec 2, 2024 1 year ago
Dec 2, 2024 1 year ago
Nov 30, 2024 1 year ago
Nov 30, 2024 1 year ago
Nov 30, 2024 1 year ago
Nov 28, 2024 1 year ago
Oct 20, 2024 2 years ago
Oct 20, 2024 2 years ago
Oct 19, 2024 2 years ago
Oct 19, 2024 2 years ago
Oct 17, 2024 2 years ago
Oct 2, 2024 2 years ago
Oct 2, 2024 2 years ago
Oct 2, 2024 2 years ago
Oct 2, 2024 2 years ago
Aug 24, 2024 2 years ago
Jun 20, 2024 2 years ago
Jun 19, 2024 2 years ago
Jun 17, 2024 2 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Google Spreadsheet to DB 6.12.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
6.12.0
Findings
1
Worst severity
medium
Content hash
7f16b07dd3ab71820885f3d0…

Findings

  • medium Stored XSS in admin Raw Data viewer via unescaped spreadsheet JSON

    xss_stored

    wp_ajax_get_spreadsheet_entry_details returns the imported row as data.raw = wp_json_encode($decoded_value) with no JSON_HEX_TAG/JSON_HEX_AMP (only optional JSON_UNESCAPED_UNICODE). initViewRawDetails / fetchSpreadsheetEntryRawDetails then passes that string to SweetAlert2 as html: `<pre>${data.data.raw}</pre>` (production bundle: html:"<pre>".concat(i.data.raw,"</pre>")). SweetAlert2 parses the html option with DOMParser and appendChilds the nodes, so event handlers run. wp_json_encode may emit \/ but JSON.parse of the admin-ajax body turns it back into /; a cell value of </pre><img src=x onerror=alert(document.domain)> therefore closes the <pre> and fires onerror in the wp-admin origin when an administrator clicks Raw Data. Writer is not a WordPress role: google_ss2db_save_spreadsheet stores whatever the Sheets API returns for the worksheet the operator imported, so any Google account that can edit that spreadsheet (collaborator, or a sheet the admin was induced to import) plants the payload. The sibling Details button runs the same JSON through RecursiveTable.escapeHtml and is safe. Subscriber cannot open the settings page or mint the google_ss2db nonce, so this is not a customer-gated WP BAC; it is stored XSS across the Sheets→wp-admin trust boundary.

    src/assets/ts/_modules/buttons.ts:154-159

    Recommendation

    Do not assign imported JSON to SweetAlert2's html option. Use the text option, or set pre.textContent = data.data.raw via a DOM node. If HTML is required, run the string through the existing RecursiveTable.escapeHtml helper (as Details already does). On the PHP side, encode with JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT so even a buggy consumer cannot break out of HTML. Keep check_ajax_referer and add current_user_can('manage_options') on the AJAX handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.