PluginScore

WordPress.DB.RestrictedFunctions.mysql_mysqli_real_escape_string

mysql mysqli real escape string

The plugin uses a raw MySQL extension or class instead of WordPress database APIs.

critical weight

Why It Shows Up

The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.

Why It Matters

Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.

How to Fix

  • Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
  • Use `$wpdb->prepare()` for dynamic values.
  • If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Backup Migration219811,09380k+Non-prefixed global variable
#2Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#3wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#4Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#5Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#6WP STAGING – WordPress Backup, Migration, Clone & Duplicate231,4891,549100k+Non-prefixed global variable
#7Participants Database249518947k+SQL query is not prepared
#8UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#9TranslatePress – Translate Multilingual sites with AI Translation254521,541400k+Non-prefixed hook name
#10WP Synchro – The Ultimate WordPress Migration Tool282432442k+Missing Translators Comment
#11User Spam Remover31115141k+Output is not escaped
#12Podlove Subscribe button38148452k+Output is not escaped