Ad Inserter – Ad Manager & AdSense Ads

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" <option value='*$client*'>$client</option>\n"'.

All output should be run through an escaping function (like echo esc_html_x() or echo esc_attr_x()), found '_ex'.

$_COOKIE[$ai_cookie_name] not unslashed before sanitization. Use wp_unslash() or similar

Detected usage of a non-sanitized input variable: $_COOKIE[$ai_cookie_name]

Processing form data without nonce verification.

rand() is discouraged. Use the far less predictable wp_rand() instead.

Multiple placeholders in translatable strings should be ordered. Expected "%1$d, %2$d", but got "%d, %d" in 'Warning: only exceptions for %d posts cleared, %d posts still have exceptions'.

Mismatched text domain. Expected 'ad-inserter' but got 'dst'.

Processing form data without nonce verification.

Scripts must be registered/enqueued via wp_enqueue_script()

Detected usage of a possibly undefined superglobal array index: $_GET[&#039;adsense-client-secret&#039;]. Check that the array index exists before using it.

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Document with ID '{$id}' isn't loaded. Use phpQuery::newDocument(\$html) or phpQuery::newDocumentFile(\$file) first."'.

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

mt_rand() is discouraged. Use the far less predictable wp_rand() instead.

strip_tags() is discouraged. Use the more comprehensive wp_strip_all_tags() instead.

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

var_dump() found. Debug code should not normally be used in production.

error_reporting() can lead to full path disclosure.

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

Use of a direct database call is discouraged.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Use placeholders and $wpdb->prepare(); found $block

Stylesheets must be registered/enqueued via wp_enqueue_style()

Linking directly to 5 stars reviews is not allowed.