ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

Instances found

Total Impact

10K

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $sql used in $wpdb->get_results($sql)\n$sql assigned unsafely at line 105:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_hide_events CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 39:\n $sql = "SHOW TABLES LIKE '" . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . "'"\n$ans assigned unsafely at line 40:\n $ans = $wpdb->get_results($sql)

Unescaped parameter $sql used in $wpdb->get_results($sql)\n$sql assigned unsafely at line 107:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_show_title CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 105:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_hide_events CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 39:\n $sql = "SHOW TABLES LIKE '" . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . "'"\n$ans assigned unsafely at line 40:\n $ans = $wpdb->get_results($sql)

Unescaped parameter $sql used in $wpdb->get_results($sql)\n$sql assigned unsafely at line 114:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_recur_multiplier INT(2) NOT NULL DEFAULT 1"\n$sql assigned unsafely at line 107:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_show_title CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 105:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_hide_events CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 39:\n $sql = "SHOW TABLES LIKE '" . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . "'"\n$ans assigned unsafely at line 40:\n $ans = $wpdb->get_results($sql)

Affected Plugins

Plugins that have instances of this rule violation

Unescaped parameter $sql used in $wpdb->get_results($sql)\n$sql assigned unsafely at line 121:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_all_day CHAR(1) DEFAULT 'T' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 114:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_recur_multiplier INT(2) NOT NULL DEFAULT 1"\n$sql assigned unsafely at line 107:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_show_title CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 105:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_hide_events CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 39:\n $sql = "SHOW TABLES LIKE '" . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . "'"\n$ans assigned unsafely at line 40:\n $ans = $wpdb->get_results($sql)

Unescaped parameter $sql used in $wpdb->get_results($sql)\n$sql assigned unsafely at line 125:\n $sql = "UPDATE ".$wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE." SET event_all_day='F' WHERE event_time != '00:00:00'"\n$sql assigned unsafely at line 121:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_all_day CHAR(1) DEFAULT 'T' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 114:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_recur_multiplier INT(2) NOT NULL DEFAULT 1"\n$sql assigned unsafely at line 107:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_show_title CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 105:\n $sql = "ALTER TABLE " . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . " ADD COLUMN event_hide_events CHAR(1) NOT NULL DEFAULT 'F' COLLATE utf8_general_ci"\n$sql assigned unsafely at line 39:\n $sql = "SHOW TABLES LIKE '" . $wpdb->get_blog_prefix().WP_SPIFFYCAL_TABLE . "'"\n$ans assigned unsafely at line 40:\n $ans = $wpdb->get_results($sql)