How to fix this plugin-check error

  • Resolved Jacob N. Breetvelt

    (@opajaap)


    3 weeks, 1 day ago

    In this piece of code, $all_ids is an array of integers of which i do not know the count:

    $wpdb->get_results( "SELECT * FROM $wpdb->wppa_albums WHERE id in (" . implode( ',', $all_ids ) . ")", ARRAY_A );

    Plugin check reports this error:

    Unescaped parameter $all_ids used in $wpdb->get_results()\n$all_ids assigned unsafely at line 2859.

    How do i fix that?

Viewing 5 replies - 1 through 5 (of 5 total)
  • Samuel O.

    (@wpcoworker)

    3 weeks, 1 day ago

    Do you know which plugin is causing this error? Are there any pending plugin updates? Please take backup of the site and update the plugins. Probably update may fix the error.

    rz.jhMark

    (@jinghuaai3)

    3 weeks, 1 day ago

    This issue is usually caused by plugins. Please go to Installed Plugins in the backend, locate any plugin related to wppa_albums, and disable it.

    Thread Starter Jacob N. Breetvelt

    (@opajaap)

    3 weeks, 1 day ago

    I am the developer of this plugin wp-photo-album-plus and i want to improve it so plugin-check no longer generates errors.

    Moderator threadi

    (@threadi)

    3 weeks, 1 day ago

    The problem is a direct SQL query without a prepared statement. This should work:

    $placeholders = implode( ',', array_fill( 0, count( $all_ids ), '%d' ) );

    $results = $wpdb->get_results(
        $wpdb->prepare(
            "SELECT * FROM $wpdb->wppa_albums WHERE id IN ($placeholders)",
            $all_ids
        ),
        ARRAY_A
    );
    Thread Starter Jacob N. Breetvelt

    (@opajaap)

    3 weeks ago

    Thank you very much, It works, so now i can also fix the other 80 locations with the same issue.

    I noticed that you can not have additional other placeholders when there is an array, so the LIMIT clause i implemented as follows:
    (other example)

    $placeholders = implode( ',', array_fill( 0, count( $photo_array ), '%d' ) );
$the_args = $photo_array;
$the_args[] = $skip;
$the_args[] = $pagesize;
$photos = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->wppa_photos WHERE id IN ($placeholders) LIMIT %d, %d", $the_args ), ARRAY_A );
Viewing 5 replies - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.