Unquoted Complex Placeholder

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

• Keep placeholders in the SQL string and pass dynamic values as separate arguments.
• Use the placeholder that matches the value type.
• Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References