Subscribe to Comments

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<li>($ccount) <a href='"'.

Use of a direct database call is discouraged.

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Processing form data without nonce verification.

Detected usage of a non-sanitized input variable: $_COOKIE[&#039;comment_author_email_&#039;. COOKIEHASH]

$_COOKIE[&#039;comment_author_email_&#039;. COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $post-&gt;post_author at &quot;SELECT * FROM $wpdb-&gt;users WHERE ID = $post-&gt;post_author&quot;

Processing form data without nonce verification.

Unescaped parameter $this-&gt;ms_table used in $wpdb-&gt;get_col()

Detected usage of a possibly undefined superglobal array index: $_GET[&#039;subscribeid&#039;]. Check that the array index exists before using it.

Missing $domain parameter in function call to __().

rand() is discouraged. Use the far less predictable wp_rand() instead.

get_currentuserinfo() has been deprecated since WordPress version 4.5.0. Use wp_get_current_user() instead.

Function "add_settings_error()" requires WordPress 3.0.0, but your plugin minimum supported version is WordPress 2.9.0.

Unescaped parameter $post->post_author used in $wpdb->get_row()\n$post->post_author used without escaping.

Detected usage of meta_value, possible slow query.

screen_icon() has been deprecated since WordPress version 3.8.0.

Attempting a database schema change is discouraged.

Detected usage of meta_key, possible slow query.

wp_redirect() found. Using wp_safe_redirect(), along with the &quot;allowed_redirect_hosts&quot; filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

query_posts() is discouraged. Use WP_Query instead.

Translatable string should not be wrapped in HTML. Found: &#039;&lt;strong&gt;Error: &lt;/strong&gt;&#039;

Mismatched text domain. Expected 'subscribe-to-comments' but got 'subscribe_to_comments'.