PluginScore

WordPress.DB.RestrictedFunctions.mysql_mysqli_real_escape_string

mysql mysqli real escape string

The plugin uses a raw MySQL extension or class instead of WordPress database APIs.

critical weight

Why It Shows Up

The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.

Why It Matters

Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.

How to Fix

  • Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
  • Use `$wpdb->prepare()` for dynamic values.
  • If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8791,9791m+Non-prefixed global variable
#2Backup Migration219991,08180k+Non-prefixed global variable
#3wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8291,53460k+Output is not escaped
#4Smart Popup by Supsystic223,02843910k+Non Singular String Literal Domain
#5WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups231,5801,786100k+Non-prefixed global variable
#6Free 1-Click WordPress Migration24224244300Direct Query
#7WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#8TranslatePress – Translate Multilingual sites with AI Translation255811,695400k+Non-prefixed hook name
#9EZ SQL Reports Shortcode Widget and DB Backup27165158500Output is not escaped
#10WP Synchro – The Ultimate WordPress Migration Tool282302382k+Missing Translators Comment
#11User Spam Remover31115141k+Output is not escaped
#12Podlove Subscribe button38148452k+Output is not escaped
#13Comment Reply Email422123500Unsafe printing function