WordPress / WordPress/plugin-check

Reduce false positives: incorrect warning about $wpdb->prepare

Open
#1,333 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
362
Forks
126
Avg merge
1d 23h
Merged PRs (30d)
22

Description

Thanks fotr this plugin, its very usefull.

I would like to point out that sometimes I get false positives. It would be great if I could exclude such from the results so that if I Check my plugin again I don't see those again.

One such false positive is

$wpdb->get_results(
   $wpdb->prepare($query, ...$args)
);

Passing the query to the prepare function leads to the following result:

ERROR | WordPress.DB.PreparedSQL.NotPrepared Use placeholders and $wpdb->prepare(); found $query
The helper function executes a passed-in query variable, which must be prepared by the caller.

Another one is this: echo $dom->saveHtml(); This does not need escaping as the html is already safe;.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the reported warnings for $wpdb->get_results($wpdb->prepare($query, ...$args)) and echo $dom->saveHtml(); using the plugin-check analysis. Trace which checks produce the messages and determine the intended false-positive handling; done means valid prepared queries and already-safe HTML no longer receive incorrect warnings without weakening real findings.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.