WordPress.DB.PreparedSQLPlaceholders.QuotedDynamicPlaceholderGeneration
Quoted Dynamic Placeholder Generation
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | Non-prefixed global variable | ||
| #2 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | Non-prefixed global variable | ||
| #3 | MotoPress Hotel Booking | 21 | 3,067 | 1,037 | 10k+ | Text Domain Mismatch | ||
| #4 | E2Pdf – Export Pdf Tool for WordPress | 22 | 1,081 | 847 | 10k+ | Unsafe printing function | ||
| #5 | easyReservations | 22 | 5,307 | 2,480 | 800 | Text Domain Mismatch | ||
| #6 | GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | 23 | 3,594 | 2,775 | 10k+ | Output is not escaped | ||
| #7 | Link Whisper Free | 23 | 3,926 | 5,402 | 30k+ | Text Domain Mismatch | ||
| #8 | Restaurant Menu and Food Ordering | 23 | 385 | 853 | 2k+ | Non-prefixed global variable | ||
| #9 | Issues and Series for Newspapers, Magazines, Publishers, Writers | 23 | 346 | 710 | 2k+ | Nonce verification recommended | ||
| #10 | Predictive Search for WooCommerce | 23 | 514 | 633 | 700 | Output is not escaped | ||
| #11 | Coupon Affiliates – Affiliate Plugin for WooCommerce | 24 | 926 | 3,141 | 5k+ | Non-prefixed global variable | ||
| #12 | Yoast SEO – Advanced SEO with real-time guidance and built-in AI | 24 | 158 | 384 | 10m+ | Non-prefixed global variable | ||
| #13 | پارسی دیت – Parsi Date | 24 | 110 | 293 | 100k+ | Non-prefixed hook name | ||
| #14 | WP Docs | 30 | 268 | 271 | 1k+ | Output is not escaped | ||
| #15 | Sublanguage | 33 | 266 | 287 | 700 | Output is not escaped | ||
| #16 | Enhanced Media Library | 36 | 361 | 117 | 60k+ | Unsafe printing function | ||
| #17 | Simple Image XML Sitemap | 37 | 119 | 16 | 1k+ | Output is not escaped | ||
| #18 | Total Sales Counts for WooCommerce | 40 | 121 | 62 | 700 | SQL query is not prepared |
