ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

832

Instances found

Total Impact

494K

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $alter_sql used in $wpdb->query($alter_sql)\n$alter_sql assigned unsafely at line 690:\n $alter_sql = sprintf('ALTER TABLE `%s` %s;', $table_name, implode(', ', $columns_to_add))\n$table_name assigned unsafely at line 664:\n $table_name => \n$all_existing_tables assigned unsafely at line 656:\n $all_existing_tables[] = $new_table_name

Unescaped parameter $apiKeys used in $wpdb->query($apiKeys)\n$apiKeys assigned unsafely at line 1395:\n $apiKeys = "CREATE TABLE IF NOT EXISTS {$wpdb->prefix}mphb_api_keys ("\n\t\t\t. ' key_id BIGINT UNSIGNED NOT NULL auto_increment,'\n\t\t\t. ' user_id BIGINT UNSIGNED NOT NULL,'\n\t\t\t. ' description varchar(200) NULL,'\n\t\t\t. ' permissions varchar(10) NOT NULL,'\n\t\t\t. ' consumer_key char(64) NOT NULL,'\n\t\t\t. ' consumer_secret char(43) NOT NULL,'\n\t\t\t. ' nonces longtext NULL,'\n\t\t\t. ' truncated_key char(7) NOT NULL,'\n\t\t\t. ' last_access datetime NULL default null,'\n\t\t\t. ' PRIMARY KEY (key_id),'\n\t\t\t. ' KEY consumer_key (consumer_key),'\n\t\t\t. ' KEY consumer_secret (consumer_secret)'\n\t\t\t. ') CHARSET=utf8 AUTO_INCREMENT=1'\n$syncUrls assigned unsafely at line 1330:\n $syncUrls = "CREATE TABLE IF NOT EXISTS {$wpdb->prefix}mphb_sync_urls ("\n\t\t\t. ' url_id INT NOT NULL AUTO_INCREMENT,'\n\t\t\t. ' room_id INT NOT NULL,'\n\t\t\t. ' sync_id VARCHAR(32) NOT NULL,'\n\t\t\t. ' calendar_url VARCHAR(250) NOT NULL,'\n\t\t\t. ' PRIMARY KEY (url_id)'\n\t\t\t. ') CHARSET=utf8 AUTO_INCREMENT=1'\n$syncQueue assigned unsafely at line 1338:\n $syncQueue = "CREATE TABLE IF NOT EXISTS {$wpdb->prefix}mphb_sync_queue ("\n\t\t\t. ' queue_id INT NOT NULL AUTO_INCREMENT,'\n\t\t\t. ' queue_name TINYTEXT NOT NULL,'\n\t\t\t. ' queue_status VARCHAR(30) NOT NULL,'\n\t\t\t. ' PRIMARY KEY (queue_id)'\n\t\t\t. ') CHARSET=utf8 AUTO_INCREMENT=1'\n$syncStats assigned unsafely at line 1345:\n $syncStats = "CREATE TABLE IF NOT EXISTS {$wpdb->prefix}mphb_sync_stats ("\n\t\t\t. ' stat_id INT NOT NULL AUTO_INCREMENT,'\n\t\t\t. ' queue_id INT NOT NULL,'\n\t\t\t. ' import_total INT NOT NULL DEFAULT 0,'\n\t\t\t. ' import_succeed INT NOT NULL DEFAULT 0,'\n\t\t\t. ' import_skipped INT NOT NULL DEFAULT 0,'\n\t\t\t. ' import_failed INT NOT NULL DEFAULT 0,'\n\t\t\t. ' clean_total INT NOT NULL DEFAULT 0,'\n\t\t\t. ' clean_done INT NOT NULL DEFAULT 0,'\n\t\t\t. ' clean_skipped INT NOT NULL DEFAULT 0,'\n\t\t\t. ' PRIMARY KEY (stat_id),'\n\t\t\t. ' UNIQUE KEY queue_id (queue_id)'\n\t\t\t. ') CHARSET=utf8 AUTO_INCREMENT=1'\n$syncLogs assigned unsafely at line 1359:\n $syncLogs = "CREATE TABLE IF NOT EXISTS {$wpdb->prefix}mphb_sync_logs ("\n\t\t\t. ' log_id INT NOT NULL AUTO_INCREMENT,'\n\t\t\t. ' queue_id INT NOT NULL,'\n\t\t\t. ' log_status VARCHAR(30) NOT NULL,'\n\t\t\t. ' log_message TEXT NOT NULL,'\n\t\t\t. ' log_context TEXT NOT NULL,'\n\t\t\t. ' PRIMARY KEY (log_id),'\n\t\t\t. ' KEY queue_id (queue_id)'\n\t\t\t. ') CHARSET=utf8 AUTO_INCREMENT=1'

Affected Plugins

Plugins that have instances of this rule violation

LatePoint – Calendar Booking Plugin for Appointments and Events

Booking for Appointments and Events Calendar – Amelia

Unescaped parameter $approved_id_str used in $wpdb->query($wpdb->prepare( "UPDATE {$wpdb->prefix}bookingdates SET approved = %s WHERE booking_id IN ( {$approved_id_str} )", $is_approve_or_pending ))\n$approved_id_str assigned unsafely at line 85:\n $approved_id_str = wpbc_clean_digit_or_csd( $approved_id_str )\n$approved_id_str assigned unsafely at line 84:\n $approved_id_str = join( ',', $approved_id )\n$approved_id assigned unsafely at line 77:\n $approved_id = wpbc_clean_digit_or_csd( $approved_id )\n$approved_id assigned unsafely at line 76:\n $approved_id = explode( '|', $booking_id )\n$booking_id assigned unsafely at line 74:\n $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''\nNote: sanitize_text_field() is not a safe escaping function.\n$_POST['booking_id'] used without escaping.

Unescaped parameter $approved_id_str used in $wpdb->query("DELETE FROM {$wpdb->prefix}booking WHERE booking_id IN ({$approved_id_str})")\n$approved_id_str assigned unsafely at line 270:\n $approved_id_str = wpbc_clean_like_string_for_db( $approved_id_str )\n$approved_id_str assigned unsafely at line 269:\n $approved_id_str = join( ',', $approved_id)\n$approved_id assigned unsafely at line 265:\n $approved_id = wpbc_clean_digit_or_csd( $approved_id )\n$approved_id assigned unsafely at line 264:\n $approved_id = explode( '|', $booking_id )\n$booking_id assigned unsafely at line 251:\n $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''\nNote: sanitize_text_field() is not a safe escaping function.\n$_POST['booking_id'] used without escaping.

Unescaped parameter $approved_id_str used in $wpdb->query("DELETE FROM {$wpdb->prefix}bookingdates WHERE booking_id IN ({$approved_id_str})")\n$approved_id_str assigned unsafely at line 270:\n $approved_id_str = wpbc_clean_like_string_for_db( $approved_id_str )\n$approved_id_str assigned unsafely at line 269:\n $approved_id_str = join( ',', $approved_id)\n$approved_id assigned unsafely at line 265:\n $approved_id = wpbc_clean_digit_or_csd( $approved_id )\n$approved_id assigned unsafely at line 264:\n $approved_id = explode( '|', $booking_id )\n$booking_id assigned unsafely at line 251:\n $booking_id = isset( $_POST['booking_id'] ) ? sanitize_text_field( wp_unslash( $_POST['booking_id'] ) ) : ''\nNote: sanitize_text_field() is not a safe escaping function.\n$_POST['booking_id'] used without escaping.