Header Footer Code Manager

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Use placeholders and $wpdb->prepare(); found $sql

Unescaped parameter $nnr_alter_sql used in $wpdb->query($nnr_alter_sql)\n$nnr_alter_sql assigned unsafely at line 172:\n $nnr_alter_sql = "ALTER TABLE `{$table_name}` ADD `spt_display_on` enum('both','posts','archives') NOT NULL DEFAULT 'both' AFTER `s_tags`"\n$table_name assigned unsafely at line 112:\n $table_name = $wpdb->prefix . self::$nnr_hfcm_table

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

The $text parameter must be a single text string literal. Found: $message

Unescaped parameter $nnr_hfcm_snippets_sql used in $wpdb->get_results($wpdb->prepare(\r\n $nnr_hfcm_snippets_sql,\r\n $nnr_hfcm_snippet_placeholder_args\r\n ))\n$nnr_hfcm_snippets_sql assigned unsafely at line 471:\n $nnr_hfcm_snippets_sql .= " AND location NOT IN ( 'header', 'footer' )"\n$nnr_hfcm_snippets_sql assigned unsafely at line 468:\n $nnr_hfcm_snippets_sql .= " AND location=%s"\n$script assigned unsafely at line 473:\n $script = $wpdb->get_results(\r\n $wpdb->prepare(\r\n $nnr_hfcm_snippets_sql,\r\n $nnr_hfcm_snippet_placeholder_args\r\n )\r\n )\n$nnr_hfcm_snippet_placeholder_args assigned unsafely at line 469:\n $nnr_hfcm_snippet_placeholder_args[] = $location\n$nnr_hfcm_snippet_placeholder_args[] used without escaping.\n$location used without escaping.

Use placeholders and $wpdb->prepare(); found $nnr_hfcm_snippets_sql

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$out'.

Use placeholders and $wpdb->prepare(); found $nnr_alter_sql

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'admin_url'.