ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

Instances found

Total Impact

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $query used in $wpdb->get_results($query)\n$query assigned unsafely at line 504:\n $query = apply_filters( 'isc_get_image_by_url_query', $raw_query, $newurl )\n$raw_query assigned unsafely at line 502:\n $raw_query = "SELECT ID, guid FROM `$wpdb->posts` WHERE post_type='attachment' AND {$url_query_string} LIMIT 1"\n$newurl assigned unsafely at line 474:\n $newurl = str_ireplace( [ 'http:', 'https:' ], '', $newurl )\n$newurl assigned unsafely at line 449:\n $newurl = esc_url( preg_replace( "/-(?:\\d+x\\d+|scaled|rotated)\\.{$ext}(.*)/i", '.' . $ext, $url ) )\n$url_query_string assigned unsafely at line 498:\n $url_query_string = implode( ' OR ', $url_queries )\n$ext assigned unsafely at line 427:\n $ext = pathinfo( $url, PATHINFO_EXTENSION )\n$url assigned unsafely at line 473:\n $url = str_ireplace( [ 'http:', 'https:' ], '', $url )\n$url assigned unsafely at line 411:\n $url = apply_filters( 'isc_filter_url_pre_get_image_by_url', $url )\n$url_queries assigned unsafely at line 496:\n $url_queries[] = 'guid = "' . esc_url( $_url ) . '"'\n$_url used without escaping.

Affected Plugins

Plugins that have instances of this rule violation

Image Source Control Lite – Show Image Credits and Captions

image-source-control-isc

issues

installs

Unescaped parameter $query used in $wpdb->get_results($wpdb->prepare( $query, 0, self::MAX_POSTS ))\n$query assigned unsafely at line 243:\n $query = "SELECT wp_posts.ID, wp_posts.post_title, wp_posts.post_parent\n\t FROM {$wpdb->posts} AS wp_posts\n\t WHERE {$where_clause}\n\t AND NOT EXISTS (\n\t SELECT 1\n\t FROM {$wpdb->postmeta} AS mt1\n\t WHERE mt1.post_id = wp_posts.ID\n\t AND mt1.meta_key = 'isc_image_source_own'\n\t AND mt1.meta_value = '1'\n\t )\n\t AND (\n\t EXISTS (\n\t SELECT 1\n\t FROM {$wpdb->postmeta} AS wp_postmeta\n\t WHERE wp_postmeta.post_id = wp_posts.ID\n\t AND wp_postmeta.meta_key = 'isc_image_source'\n\t AND wp_postmeta.meta_value = ''\n\t )\n\t OR NOT EXISTS (\n\t SELECT 1\n\t FROM {$wpdb->postmeta} AS mt2\n\t WHERE mt2.post_id = wp_posts.ID\n\t AND mt2.meta_key = 'isc_image_source'\n\t )\n\t )\n\t ORDER BY wp_posts.ID DESC\n\t LIMIT %d, %d\n\t "\n$where_clause assigned unsafely at line 237:\n $where_clause .= " AND wp_posts.post_mime_type LIKE 'image/%'"\n$where_clause assigned unsafely at line 233:\n $where_clause = "wp_posts.post_type = 'attachment' AND wp_posts.post_status = 'inherit'"