Polls CP

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$color_array[$count]'.

Use placeholders and $wpdb->prepare(); found $this

Use placeholders and $wpdb->prepare(); found table_messages

Unescaped parameter $sql used in $wpdb->query($sql)\n$sql assigned unsafely at line 25:\n $sql = "CREATE TABLE ".$wpdb->prefix.$this->table_messages." (\n id mediumint(9) NOT NULL AUTO_INCREMENT,\n formid INT NOT NULL,\n time datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,\n ipaddr VARCHAR(250) DEFAULT '' NOT NULL,\n notifyto VARCHAR(250) DEFAULT '' NOT NULL,\n data mediumtext,\n posted_data mediumtext,\n UNIQUE KEY id (id)\n ) ".$charset_collate.";"

Use placeholders and $wpdb->prepare(); found $sql

Use placeholders and $wpdb->prepare(); found $this

Use placeholders and $wpdb->prepare(); found table_items

Unescaped parameter $sql used in $wpdb->query($sql)\n$sql assigned unsafely at line 41:\n $sql = "CREATE TABLE ".$wpdb->prefix.$this->table_items." (\n id mediumint(9) NOT NULL AUTO_INCREMENT,\n\n form_name VARCHAR(250) DEFAULT '' NOT NULL,\n\n form_structure mediumtext,\n\n poll_limit VARCHAR(10) DEFAULT '' NOT NULL,\n poll_private_reports VARCHAR(10) DEFAULT '' NOT NULL,\n poll_see_results VARCHAR(10) DEFAULT '' NOT NULL,\n poll_text_seeres VARCHAR(250) DEFAULT '' NOT NULL,\n poll_text_private VARCHAR(250) DEFAULT '' NOT NULL,\n poll_text_votes VARCHAR(250) DEFAULT '' NOT NULL,\n\n fp_from_email VARCHAR(250) DEFAULT '' NOT NULL,\n fp_destination_emails text,\n fp_subject VARCHAR(250) DEFAULT '' NOT NULL,\n fp_inc_additional_info VARCHAR(10) DEFAULT '' NOT NULL,\n fp_return_page VARCHAR(250) DEFAULT '' NOT NULL,\n fp_message text,\n fp_emailformat VARCHAR(10) DEFAULT '' NOT NULL,\n\n cu_enable_copy_to_user VARCHAR(10) DEFAULT '' NOT NULL,\n cu_user_email_field VARCHAR(250) DEFAULT '' NOT NULL,\n cu_subject VARCHAR(250) DEFAULT '' NOT NULL,\n cu_message text,\n cu_emailformat VARCHAR(10) DEFAULT '' NOT NULL,\n fp_emailfrommethod VARCHAR(10) DEFAULT '' NOT NULL,\n\n vs_use_validation VARCHAR(10) DEFAULT '' NOT NULL,\n vs_text_is_required VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_is_email VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_datemmddyyyy VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_dateddmmyyyy VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_number VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_digits VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_max VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_min VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_submitbtn VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_previousbtn VARCHAR(250) DEFAULT '' NOT NULL,\n vs_text_nextbtn VARCHAR(250) DEFAULT '' NOT NULL, \n\n rep_enable VARCHAR(10) DEFAULT '' NOT NULL,\n rep_days VARCHAR(10) DEFAULT '' NOT NULL,\n rep_hour VARCHAR(10) DEFAULT '' NOT NULL,\n rep_emails text,\n rep_subject text,\n rep_emailformat VARCHAR(10) DEFAULT '' NOT NULL,\n rep_message text,\n\n cv_enable_captcha VARCHAR(10) DEFAULT '' NOT NULL,\n cv_width VARCHAR(20) DEFAULT '' NOT NULL,\n cv_height VARCHAR(20) DEFAULT '' NOT NULL,\n cv_chars VARCHAR(20) DEFAULT '' NOT NULL,\n cv_font VARCHAR(20) DEFAULT '' NOT NULL,\n cv_min_font_size VARCHAR(20) DEFAULT '' NOT NULL,\n cv_max_font_size VARCHAR(20) DEFAULT '' NOT NULL,\n cv_noise VARCHAR(20) DEFAULT '' NOT NULL,\n cv_noise_length VARCHAR(20) DEFAULT '' NOT NULL,\n cv_background VARCHAR(20) DEFAULT '' NOT NULL,\n cv_border VARCHAR(20) DEFAULT '' NOT NULL,\n cv_text_enter_valid_captcha VARCHAR(250) DEFAULT '' NOT NULL,\n\n UNIQUE KEY id (id)\n ) ".$charset_collate.";"\n$sql assigned unsafely at line 25:\n $sql = "CREATE TABLE ".$wpdb->prefix.$this->table_messages." (\n id mediumint(9) NOT NULL AUTO_INCREMENT,\n formid INT NOT NULL,\n time datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,\n ipaddr VARCHAR(250) DEFAULT '' NOT NULL,\n notifyto VARCHAR(250) DEFAULT '' NOT NULL,\n data mediumtext,\n posted_data mediumtext,\n UNIQUE KEY id (id)\n ) ".$charset_collate.";"

Use placeholders and $wpdb->prepare(); found $sql

Use placeholders and $wpdb->prepare(); found $this