WP Statistics – Simple, privacy-friendly Google Analytics alternative

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $conditionQuery at "SELECT COUNT(*) FROM {$this->fullName} WHERE $conditionQuery"

Sample message

$_GET[$dynamicAssetKey] not unslashed before sanitization. Use wp_unslash() or similar

Sample message

Unescaped parameter $columns used in $wpdb->get_row()\n$columns assigned unsafely at line 93.

Sample message

Processing form data without nonce verification.

Sample message

Detected usage of a non-sanitized input variable: $_GET['current_page']

Sample message

The $text parameter must be a single text string literal. Found: $name

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "WP_Statistics".

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$hookName".

Sample message

Translatable string should not be wrapped in HTML. Found: '<b>Hints on Capabilities:</b>'

Sample message

Detected usage of a possibly undefined superglobal array index: $_GET['name']. Check that the array index exists before using it.

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "ExportData".

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "WP_STATISTICS_DIR".

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

Sample message

The use of function ini_set() is discouraged

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().