Unescaped parameter $count_query used in $wpdb->get_var($count_query)\n$count_query assigned unsafely at line 143:\n $count_query = "$count_query WHERE posts.ID NOT IN ($not_in)"\n$count_query assigned unsafely at line 140:\n $count_query = "SELECT COUNT(posts.ID) FROM ($posts_query) AS posts"\n$posts_query assigned unsafely at line 119:\n $posts_query = $this->prepare_posts_query( array( 'ID' ) )
Unescaped parameter $meta_query used in $wpdb->get_col($meta_query)\n$meta_query assigned unsafely at line 293:\n $meta_query = "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key LIKE '{$prefix}%' AND post_id NOT IN ({$not_in}) GROUP BY post_id"\n$prefix used without escaping.\n$not_in assigned unsafely at line 292:\n $not_in = $posts_with_target_meta ? $posts_with_target_meta : '-1'\n$posts_with_target_meta assigned unsafely at line 291:\n $posts_with_target_meta = implode( ',', $this->get_posts_with_target_metas() )
Unescaped parameter $post_query used in $wpdb->get_results($post_query)\n$post_query assigned unsafely at line 126:\n $post_query = "SELECT posts.*, canonical.meta_value AS canonical FROM ($posts_query) AS posts JOIN $wpdb->postmeta AS canonical ON ID = canonical.post_id AND canonical.meta_key = '_wds_canonical' AND canonical.meta_value != ''"\n$posts_query assigned unsafely at line 119:\n $posts_query = $this->prepare_posts_query( array( 'ID' ) )
Affected Plugins
Plugins that have instances of this rule violation
Unescaped parameter $query used in $wpdb->get_results($query)\n$query assigned unsafely at line 101:\n $query = "SELECT posts.*, canonical.meta_value AS canonical FROM ($posts_query) AS posts " .\n\t\t\t\t"LEFT OUTER JOIN $wpdb->postmeta AS canonical ON ID = canonical.post_id AND canonical.meta_key = '_wds_canonical'"\n$posts_query assigned unsafely at line 96:\n $posts_query = $this->prepare_posts_query( $columns )\n$columns assigned unsafely at line 91:\n $columns = array_merge(\n\t\t\t$columns,\n\t\t\t$this->get_extra_columns()\n\t\t)
Unescaped parameter $query used in $wpdb->get_results($wpdb->prepare( $query, ...$kws ))\n$query assigned unsafely at line 63:\n $query = "SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = '_wds_focus-keywords' AND post_id != $subject_id AND $likes ORDER BY post_id DESC"\n$subject_id assigned unsafely at line 60:\n $subject_id = $this->get_subject_post_id( $subject )\n$likes assigned unsafely at line 62:\n $likes = join( ' AND ', $likes_array )\n$subject assigned unsafely at line 59:\n $subject = $this->get_subject()\n$likes_array assigned unsafely at line 55:\n $likes_array[] = 'meta_value LIKE %s'\n$kws[$kw_id] assigned unsafely at line 56:\n $kws[ $kw_id ] = $wild . $wpdb->esc_like( $kw ) . $wild\n$kw_id assigned unsafely at line 54:\n $kw_id => \n$wild assigned unsafely at line 52:\n $wild = '%'\n$kw used without escaping.\n$likes_array[] used without escaping.