Database parameter is not escaped

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

• Use `$wpdb->prepare()` for values.
• Use explicit allowlists for table names, column names, order fields, and directions.
• Sanitize and validate request data before it reaches query construction.

References