Security Safe

Sample message

Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 11.

Sample message

Detected usage of a non-sanitized input variable: $_FILES['import-file']

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: chmod().

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$s", but got "%s, %s" in '%s: All content policies are disabled. You can enable them at the top of <a href="%s">Content Settings</a>.'.

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;DONOTCACHEDB&quot;.

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$Janitor&quot;.

Sample message

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $ids at &quot;DELETE FROM $table WHERE ID IN ( $ids )&quot;

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES[&#039;import-file&#039;]. Check that the array index exists before using it.

Sample message

Scripts must be registered/enqueued via wp_enqueue_script()

Sample message

Translatable string should not be wrapped in HTML. Found: &#039;&lt;i&gt;NOTICE: Files which cannot be modified are hidden. &lt;a href=&quot;%s&quot; style=&quot;text-decoration: underline;&quot;&gt;Show all files&lt;/a&gt;.&lt;/i&gt;&#039;

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

Sample message

Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 162.

Sample message

Unescaped parameter $table used in $wpdb-&gt;query()\n$table assigned unsafely at line 209.

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;security_safe_loaded&quot;.

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$slug&quot;.