WP-PostRatings

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<$start_tag $attributes data-nonce=\""'.

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$base_name&quot;.

Sample message

Use placeholders and $wpdb-&gt;prepare(); found interpolated variable $category_sql at &quot;SELECT COUNT($wpdb-&gt;ratings.rating_postid) AS ratings_users, SUM($wpdb-&gt;ratings.rating_rating) AS ratings_score, ROUND(((SUM($wpdb-&gt;ratings.rating_rating)/COUNT($wpdb-&gt;ratings.rating_postid))), 2) AS ratings_average, $wpdb-&gt;posts.ID FROM $wpdb-&gt;posts LEFT JOIN $wpdb-&gt;ratings ON $wpdb-&gt;ratings.rating_postid = $wpdb-&gt;posts.ID INNER JOIN $wpdb-&gt;term_relationships ON ($wpdb-&gt;posts.ID = $wpdb-&gt;term_relationships.object_id) INNER JOIN $wpdb-&gt;term_taxonomy ON ($wpdb-&gt;term_relationships.term_taxonomy_id = $wpdb-&gt;term_taxonomy.term_taxonomy_id) WHERE rating_timestamp &gt;= $min_time AND $wpdb-&gt;posts.post_password = &#039;&#039; AND $wpdb-&gt;posts.post_date &lt; NOW() AND $wpdb-&gt;posts.post_status = &#039;publish&#039; AND $wpdb-&gt;term_taxonomy.taxonomy = &#039;category&#039; AND $category_sql AND $where GROUP BY $wpdb-&gt;ratings.rating_postid ORDER BY $order_by DESC, ratings_users DESC LIMIT %d&quot;

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;add_ratings_fields&quot;.

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Sample message

Use of a direct database call is discouraged.

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: &quot;rate_post&quot;.

Sample message

$_COOKIE[&#039;comment_author_&#039;.COOKIEHASH] not unslashed before sanitization. Use wp_unslash() or similar

Sample message

Detected usage of a non-sanitized input variable: $_COOKIE[&#039;comment_author_&#039;.COOKIEHASH]

Sample message

Unescaped parameter $post_ids used in $wpdb->query()\n$post_ids assigned unsafely at line 71.