ERRORsecurity

UnescapedDBParameter

PluginCheck.Security.DirectDB.UnescapedDBParameter

Affected Plugins

On this page

Total Issues

303

Instances found

Total Impact

23K

Active installations

Examples

Real messages found in scanned plugins

Unescaped parameter $access_table used in $wpdb->get_row($wpdb->prepare(\r\n\t\t\t\t\t"SELECT SUM( con_price ) AS total_con_price, COUNT(*) AS count FROM {$access_table}\r\n\t\t\t\t\tWHERE con_status = %s\r\n\t\t\t\t\tAND con_next_charging >= %s AND con_next_charging <= %s",\r\n\t\t\t\t\t'continuation',\r\n\t\t\t\t\t$this_month,\r\n\t\t\t\t\t$next_month\r\n\t\t\t\t))\n$access_table assigned unsafely at line 603:\n $access_table = $wpdb->prefix . 'usces_continuation'\n$conres assigned unsafely at line 612:\n $conres = $wpdb->get_row(\r\n\t\t\t\t$wpdb->prepare(\r\n\t\t\t\t\t"SELECT SUM( con_price ) AS total_con_price, COUNT(*) AS count FROM {$access_table}\r\n\t\t\t\t\tWHERE con_status = %s\r\n\t\t\t\t\tAND con_next_charging >= %s AND con_next_charging <= %s",\r\n\t\t\t\t\t'continuation',\r\n\t\t\t\t\t$this_month,\r\n\t\t\t\t\t$next_month\r\n\t\t\t\t),\r\n\t\t\t\tARRAY_A\r\n\t\t\t)\n$this_month assigned unsafely at line 610:\n $this_month = substr( $this_month, 0, 10 )\n$this_month assigned unsafely at line 568:\n $this_month = wp_date( 'Y-m-d H:i:s', $this_month_time )\n$next_month assigned unsafely at line 611:\n $next_month = substr( $next_month, 0, 10 )\n$next_month assigned unsafely at line 570:\n $next_month = wp_date( 'Y-m-d H:i:s', $next_month_time )

Affected Plugins

Plugins that have instances of this rule violation

Image Uploader for Welcart

image-uploader-for-welcart

issues

installs

Unescaped parameter $access_table used in $wpdb->get_var("SHOW TABLES LIKE '$access_table'")\n$access_table assigned unsafely at line 6146:\n $access_table = $wpdb->prefix . 'usces_access'\n$member_table assigned unsafely at line 6147:\n $member_table = $wpdb->prefix . 'usces_member'\n$member_meta_table assigned unsafely at line 6148:\n $member_meta_table = $wpdb->prefix . 'usces_member_meta'\n$order_table assigned unsafely at line 6149:\n $order_table = $wpdb->prefix . 'usces_order'\n$order_meta_table assigned unsafely at line 6150:\n $order_meta_table = $wpdb->prefix . 'usces_order_meta'

Unescaped parameter $acting_log_table used in $wpdb->get_var("SHOW TABLES LIKE '$acting_log_table'")\n$acting_log_table assigned unsafely at line 6154:\n $acting_log_table = $wpdb->prefix . 'usces_acting_log'\n$item_table assigned unsafely at line 6155:\n $item_table = $wpdb->prefix . 'usces_item'\n$sku_table assigned unsafely at line 6156:\n $sku_table = $wpdb->prefix . 'usces_skus'\n$opt_table assigned unsafely at line 6157:\n $opt_table = $wpdb->prefix . 'usces_opts'\n$admin_log_table assigned unsafely at line 6158:\n $admin_log_table = $wpdb->prefix . 'usces_admin_log'