ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

Instances found

Total Impact

10K

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $this->wpdb->prefix used in $wpdb->get_row($this->wpdb->prepare(\r\n\t\t\t\t\t"SELECT * FROM `{$this->wpdb->prefix}ezcache_webp_images` WHERE `uid` = %s LIMIT 1",\r\n\t\t\t\t\t[ sha1( $image_path ) ]\r\n\t\t\t\t))

Unescaped parameter $this->wpdb->prefix used in $wpdb->query($this->wpdb->prepare(\r\n\t\t\t\t\t"INSERT IGNORE INTO `{$this->wpdb->prefix}ezcache_webp_images` (`uid`, `url`, `webp_url`, `path`, `webp_path`, `status`, `created_at`, `updated_at`) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)",\r\n\t\t\t\t\t[\r\n\t\t\t\t\t\tsha1( $image_path ),\r\n\t\t\t\t\t\t$image_url,\r\n\t\t\t\t\t\t$image_webp_url,\r\n\t\t\t\t\t\t$image_path,\r\n\t\t\t\t\t\t$image_webp_path,\r\n\t\t\t\t\t\t'pending',\r\n\t\t\t\t\t\tdate( 'Y-m-d H:i:s' ),\r\n\t\t\t\t\t\tdate( 'Y-m-d H:i:s' )\r\n\t\t\t\t\t]\r\n\t\t\t\t))

Unescaped parameter $this->wpdb->prefix used in $wpdb->query($this->wpdb->prepare(\r\n\t\t\t\t\t\t"DELETE FROM `{$this->wpdb->prefix}ezcache_webp_images` WHERE `id` = %d",\r\n\t\t\t\t\t\t[ $image->id ]\r\n\t\t\t\t\t))

Affected Plugins

Plugins that have instances of this rule violation

ezcache

Unescaped parameter $where used in $wpdb->get_results("SELECT * FROM `{$wpdb->prefix}ezcache_webp_images` {$where}")\n$where assigned unsafely at line 991:\n $where = $delete_all ? '' : "WHERE `status` = 'completed'"\n$images assigned unsafely at line 992:\n $images = $wpdb->get_results( "SELECT * FROM `{$wpdb->prefix}ezcache_webp_images` {$where}" )