Zero Spam for WordPress

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$all_types".

Use placeholders and $wpdb->prepare(); found interpolated variable $database_table at "SELECT * FROM `$database_table`$where_statement$order_statement $limit_statement"

Unescaped parameter $log_table used in $wpdb->get_results()\n$log_table assigned unsafely at line 198.

Processing form data without nonce verification.

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$time'.

Use of a direct database call is discouraged.

$_GET['zerospam_rescue'] not unslashed before sanitization. Use wp_unslash() or similar

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

Use placeholders and $wpdb->prepare(); found $count_query

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

Detected usage of a possibly undefined superglobal array index: $_POST['blocked_end_date']. Check that the array index exists before using it.

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

Detected usage of a non-sanitized input variable: $_POST['json']

Translatable string should not be wrapped in HTML. Found: '<p>When using .htaccess & due to <a href="%s" target="_blank" rel="noreferrer noopener">character limit restrictions</a>, <strong>no more than 170 blocked IP addresses recommended</strong>.</p>'

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Found call to wp_enqueue_script() with external resource. Offloading scripts to your servers or any remote service is disallowed.

Unescaped parameter $count_query used in $wpdb->get_var()\n$count_query assigned unsafely at line 282.

The plugin name includes a restricted term. Your chosen plugin name - "Zero Spam for WordPress" - contains the restricted term "wordpress" which cannot be used at all in your plugin name.

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

Attempting a database schema change is discouraged.

Replacement variables found, but no valid placeholders found in the query.

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DONOTCACHEPAGE".

Processing form data without nonce verification.

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: is_writable().