Interpolated SQL is not prepared

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

• Replace interpolated variables with placeholders.
• Pass each dynamic value as a separate `$wpdb->prepare()` argument.
• Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References