CheckView – Form & Checkout Testing

Unescaped parameter $tablename used in $wpdb->get_results($wpdb->prepare( 'Select * from ' . $tablename . ' where status=%s order by ID ASC', 'published' ))\n$tablename assigned unsafely at line 1530:\n $tablename = $wpdb->prefix . 'fluentform_forms'\n$tablename assigned unsafely at line 1479:\n $tablename = $wpdb->prefix . 'gf_addon_feed'\n$tablename assigned unsafely at line 1471:\n $tablename = $wpdb->prefix . 'gf_form'\n$results assigned unsafely at line 1531:\n $results = $wpdb->get_results( $wpdb->prepare( 'Select * from ' . $tablename . ' where status=%s order by ID ASC', 'published' ) )\n$addons assigned unsafely at line 1480:\n $addons = $wpdb->get_results( $wpdb->prepare( 'Select * from ' . $tablename . ' where is_active=%d and form_id=%d', 1, $row->id ) )\n$row->id used without escaping.

Unescaped parameter $tablename used in $wpdb->get_row($wpdb->prepare( 'Select * from ' . $tablename . ' where id=%d and form_id=%d LIMIT 1', $entry_id, $form_id ))\n$tablename assigned unsafely at line 335:\n $tablename = $wpdb->prefix . 'gf_entry'\n$tablename assigned unsafely at line 306:\n $tablename = $wpdb->prefix . 'gf_entry_meta'\n$row assigned unsafely at line 336:\n $row = $wpdb->get_row( $wpdb->prepare( 'Select * from ' . $tablename . ' where id=%d and form_id=%d LIMIT 1', $entry_id, $form_id ), ARRAY_A )\n$entry_id used without escaping.\n$form_id used without escaping.\n$rows assigned unsafely at line 307:\n $rows = $wpdb->get_results( $wpdb->prepare( 'Select * from ' . $tablename . ' where entry_id=%d and form_id=%d order by id ASC', $entry_id, $form_id ) )

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CV_DISABLE_WEBHOOKS".

Use placeholders and $wpdb->prepare(); found $table_name

Use placeholders and $wpdb->prepare(); found $tablename

Unescaped parameter $query used in $wpdb->get_row($query)\n$query assigned unsafely at line 1934:\n $query = $wpdb->prepare( 'Select * from ' . $table_name . ' where uid=%s', $uid )\n$table_name assigned unsafely at line 1933:\n $table_name = $wpdb->prefix . 'cv_entry'\n$uid assigned unsafely at line 1922:\n $uid = isset( $uid ) ? sanitize_text_field( $uid ) : null\nNote: sanitize_text_field() is not a safe escaping function.\n$uid assigned unsafely at line 1921:\n $uid = $request->get_param( 'uid' )\n$request used without escaping.

Missing $domain parameter in function call to translate().

Your plugin has a different license declared in the readme file and plugin header. Please update your readme with a valid GPL license identifier.

Unescaped parameter $tablename used in $wpdb->get_results($wpdb->prepare( 'Select * from ' . $tablename . ' where post_id=%d', $entry_id ))\n$tablename assigned unsafely at line 194:\n $tablename = $wpdb->prefix . 'postmeta'\n$form_fields assigned unsafely at line 195:\n $form_fields = $wpdb->get_results( $wpdb->prepare( 'Select * from ' . $tablename . ' where post_id=%d', $entry_id ) )\n$entry_id assigned unsafely at line 162:\n $entry_id = isset( $form_data['actions']['save']['sub_id'] ) ? $form_data['actions']['save']['sub_id'] : 0\n$form_data['actions']['save']['sub_id'] used without escaping.