HT Contact Form – Drag & Drop Form Builder for WordPress

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $placeholders at "UPDATE {$this->table} SET status = %s, viewed_at = %s, updated_at = %s WHERE id IN ($placeholders)"

Sample message

$_GET['code'] not unslashed before sanitization. Use wp_unslash() or similar

Sample message

The $text parameter must be a single text string literal. Found: "Hello,\n\n" .\n "Your form progress has been saved. You can continue filling out the form by clicking the link below:\n\n" .\n "%1\$s\n\n" .\n "This link will expire on %2\$s.\n\n" .\n "If you did not request this email, you can safely ignore it.\n\n" .\n "Best regards,\n%3\$s"

Sample message

Found call to wp_register_script() with external resource. Offloading scripts to your servers or any remote service is disallowed.

Sample message

Resource version not set in call to wp_register_script(). This means new versions of the script may not always be loaded due to browser caching.

Sample message

Unescaped parameter $count_query used in $wpdb->get_var()\n$count_query assigned unsafely at line 181.

Sample message

Use placeholders and $wpdb->prepare(); found $batch_delete_query

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES['ht_form_file']. Check that the array index exists before using it.

Sample message

unlink() is discouraged. Use wp_delete_file() to delete a file.

Sample message

Editor blocks must define "apiVersion" 3 or higher in block.json for WordPress 7.0+ iframe editor compatibility.

Sample message

Detected usage of a non-sanitized input variable: $_FILES['ht_form_file']

Sample message

Mismatched text domain. Expected 'ht-contactform' but got 'cf7-extensions'.

Sample message

File and folder names must not contain spaces or special characters.

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

Sample message

Attempting a database schema change is discouraged.