ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

Instances found

Total Impact

96K

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $column used in $wpdb->get_results("SELECT DISTINCT $column FROM $wpdb->stream")\n$column used without escaping.

Unescaped parameter $count_query used in $wpdb->get_var($count_query)\n$count_query assigned unsafely at line 268:\n $count_query = apply_filters( 'wp_stream_db_count_query', $count_query, $args )\n$count_query assigned unsafely at line 255:\n $count_query = "SELECT COUNT(*) as found\n\t\tFROM $wpdb->stream\n\t\t{$join}\n\t\tWHERE 1=1 {$where}"\n$args used without escaping.\n$join assigned unsafely at line 31:\n $join = ''\n$where assigned unsafely at line 232:\n $where = apply_filters( 'wp_stream_db_query_where', $where )\n$where assigned unsafely at line 162:\n $where .= $wpdb->prepare( " AND $wpdb->stream.%s NOT IN {$format}", $field, $value )\n$format assigned unsafely at line 161:\n $format = '(' . join( ',', array_fill( 0, count( $value ), $type ) ) . ')'\n$type assigned unsafely at line 158:\n $type = is_numeric( array_shift( $value ) ) ? '%d' : '%s'\n$type assigned unsafely at line 130:\n $type = is_numeric( array_shift( $value ) ) ? '%d' : '%s'

Affected Plugins

Plugins that have instances of this rule violation

stream

Unescaped parameter $entry_count_query used in $wpdb->get_var($entry_count_query)\n$entry_count_query assigned unsafely at line 182:\n $entry_count_query = $wpdb->prepare(\n "SELECT count(id) FROM %i WHERE 1 = 1 and DATE_FORMAT(sent_date,GET_FORMAT(DATE,'JIS')) >= %s and DATE_FORMAT(sent_date,GET_FORMAT(DATE,'JIS')) <= %s ". $this->get_filter_params($params),\n $table_name,\n $params['startDate'],\n $params['endDate'],\n )\n$params assigned unsafely at line 136:\n $params = $this->get_params( $request )\n$request used without escaping.

Unescaped parameter $entry_query used in $wpdb->get_results($entry_query)\n$entry_query assigned unsafely at line 165:\n $entry_query = $wpdb->prepare(\n\t\t\t"SELECT DISTINCT id, to_email, subject, message, headers, attachments, DATE_FORMAT(sent_date, '%%Y/%%m/%%d %%H:%%i:%%S') as sent_date ,attachments_file as files FROM %i WHERE 1 = 1 and DATE_FORMAT(sent_date,GET_FORMAT(DATE,'JIS')) >= %s and DATE_FORMAT(sent_date,GET_FORMAT(DATE,'JIS')) <= %s ".$this->get_filter_params($params)." order by id desc limit %d",\n\t\t\t$table_name,\n\t\t\t$params['startDate'],\n\t\t\t$params['endDate'],\n\t\t\t$limit\n\t\t)\n$params assigned unsafely at line 136:\n $params = $this->get_params( $request )\n$request used without escaping.