$wpdb->prepare error after Wordpress update [duplicate]

Question

Possible Duplicate:
$wpdb->prepare() warning in WordPress 3.5

Im facing with a error after updated Wordpress to 3.5, Im aware of error but I cant fix it.

This is code:

 $wpdb->prepare("INSERT INTO $orders_table ( theme_name, user_id, order_status, order_verified, order_date, order_payment_method, order_ip  )VALUES ( %s,  %d,  %d,  %d,  %s,  %s, %s)",$theme_name, $user_id, $order_status, $order_verified, $date_now, $order_payment_method, $ip)

$wpdb->prepare("SELECT COUNT(*) FROM $orders_table where theme_name='$theme_name' && order_verified = '1';")

$wpdb->prepare("SELECT COUNT(*) FROM $orders_table where theme_name='$theme_name' && order_verified = '1' && DAY(order_date) = '$fa_today' && MONTH(order_date) = '$fa_this_month' && YEAR(order_date) = '$fa_this_year';")

Can someone please update code above?

Thanks

Answer 1

Because you're missing second argument, for more information see this post - http://make.wordpress.org/core/2012/12/12/php-warning-missing-argument-2-for-wpdb-prepare/.

Also you're doing it wrong, for security reason you shouldn't pass variables into query directly that's why you should use prepare() method - see Codex for usage info.

Answer 2

You should pass the variables (theme_name and user_id) in that string as parameters, and use %s and %d as place holder from them like it is done in the sprintf kind of functions.

$wpdb->prepare("SELECT order_id FROM $orders_table WHERE theme_name='%s' && user_id='%d' && order_status='0' && order_verified ='0' ",$theme_name,$user_id)