WordPress.DB.PreparedSQLPlaceholders.UnescapedLiteral
Unescaped Literal
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | Output is not escaped | ||
| #2 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | Non-prefixed global variable | ||
| #3 | Fix Alt Text | 24 | 544 | 346 | 1k+ | Non Singular String Literal Domain | ||
| #4 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 24 | 422 | 601 | 10k+ | Missing Translators Comment | ||
| #5 | EZ SQL Reports Shortcode Widget and DB Backup | 27 | 165 | 158 | 500 | Output is not escaped | ||
| #6 | Product Labels For Woocommerce (Sale Badges) | 36 | 90 | 48 | 10k+ | Output is not escaped |
