WebTotem Security

Sample message

Use placeholders and $wpdb->prepare(); found $add_status_column

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$page_content'.

Sample message

Detected usage of a non-sanitized input variable: $_FILES['pluginzip']['name']

Sample message

$_POST[$key] not unslashed before sanitization. Use wp_unslash() or similar

Sample message

Attempting a database schema change is discouraged.

Sample message

Detected usage of a possibly undefined superglobal array index: $_FILES['pluginzip']['name']. Check that the array index exists before using it.

Sample message

Processing form data without nonce verification.

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

Sample message

Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

Sample message

Unescaped parameter $add_status_column used in $wpdb->query()\n$add_status_column assigned unsafely at line 109.

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cron_add_some_min".

Sample message

Scripts must be registered/enqueued via wp_enqueue_script()

Sample message

Writing files using ABSPATH may be problematic. Consider using wp_upload_dir() instead if storing user data or generated files.

Sample message

The use of function ini_set() is discouraged

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "login_errors".