WordPress.DB.PreparedSQLPlaceholders.QuotedDynamicPlaceholderGeneration
Quoted Dynamic Placeholder Generation
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | Non-prefixed global variable | ||
| #2 | E2Pdf – Export Pdf Tool for WordPress | 22 | 1,081 | 852 | 10k+ | Unsafe printing function | ||
| #3 | easyReservations | 22 | 5,307 | 2,480 | 700 | Text Domain Mismatch | ||
| #4 | MotoPress Hotel Booking | 22 | 3,067 | 1,050 | 10k+ | Text Domain Mismatch | ||
| #5 | GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | 23 | 3,403 | 2,483 | 10k+ | Output is not escaped | ||
| #6 | Link Whisper Free | 23 | 3,944 | 5,456 | 30k+ | Text Domain Mismatch | ||
| #7 | Restaurant Menu and Food Ordering | 23 | 385 | 829 | 2k+ | Non-prefixed global variable | ||
| #8 | Predictive Search for WooCommerce | 23 | 514 | 633 | 700 | Output is not escaped | ||
| #9 | Yoast SEO – Advanced SEO with real-time guidance and built-in AI | 24 | 160 | 385 | 10m+ | Non-prefixed global variable | ||
| #10 | پارسی دیت – Parsi Date | 25 | 130 | 321 | 100k+ | Non-prefixed hook name | ||
| #11 | Staatic – Static Site Generator for WordPress | 30 | 449 | 234 | 3k+ | SQL query is not prepared | ||
| #12 | WP Docs | 30 | 266 | 254 | 1k+ | Output is not escaped | ||
| #13 | Sublanguage | 33 | 266 | 287 | 700 | Output is not escaped | ||
| #14 | Enhanced Media Library | 36 | 361 | 117 | 60k+ | Unsafe printing function | ||
| #15 | Simple Image XML Sitemap | 37 | 119 | 16 | 1k+ | Output is not escaped | ||
| #16 | Total Sales Counts for WooCommerce | 40 | 121 | 62 | 700 | SQL query is not prepared |
