Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I modified an abandoned Stackoverflow form of badge plugin to work with Wordpress 3.4.2 and it does indeed. The full script for it is here: http://pastebin.com/Ta91zXiL

When upgrading to Wordpress v3.5, I receive these warnings when publishing a post (or post a comment):

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 355 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 355 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 342 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 355 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /public_html/wp-content/plugins/rockhoist-badges/rh-badges.php on line 355 and defined in /public_html/wp-includes/wp-db.php on line 990

Warning: Cannot modify header information - headers already sent by (output started at /public_html/wp-includes/wp-db.php:990) in /public_html/wp-includes/pluggable.php on line 876

So it seems to be related to lines 342 and 355:

function rhb_get_user_comment_count( $args = '' ) {

        global $wpdb;

        $comment_count = $wpdb->get_var($wpdb->prepare( "SELECT COUNT(*)
                FROM " . $wpdb->prefix . "comments
                WHERE user_id = " . $args['user_ID'] . "
                AND comment_approved = '1'" ) ); // line 342

        return $comment_count;
}

function rhb_get_user_post_count( $args = '' ) {

        global $wpdb;

        $post_count = $wpdb->get_var($wpdb->prepare( "SELECT COUNT(*)
                FROM " . $wpdb->prefix . "posts
                WHERE post_author = " . $args['user_ID'] . "
                AND post_status = 'publish'
                AND post_type = 'post'" ) ); // line 355

        return $post_count;
}

I have been trying to understand these warnings all day but failed. Can someone kindly assist me to fix this issue so that we can have a working version of this very useful badge system for WP 3.5?

share|improve this question
1  
I do not believe this question is an exact duplicate of the referenced question. The referenced question uses $wpdb->prepare() needlessly, and its solution is to remove $wpdb->prepare(). It does not address the change required for proper usage of $wpdb->prepare() in WordPress 3.5. This question does, and IMHO should be allowed to stand on its own. –  Chip Bennett Dec 18 '12 at 20:06

1 Answer 1

up vote 6 down vote accepted

Lead developer Nacin answers this one:

Hello plugin or theme author! You possibly found this post after searching the Internet for the error above: “PHP Warning: Missing argument 2 for wpdb::prepare().”

So, this is a new warning in 3.5. No sites are broken, everything is fine as before. But, this is indeed something you need to look at, because you may be exposing your users to a possible SQL injection vulnerability. Now that’s no fun!

Have a read of the rest, for further explanation.

As for rehabilitating your existing code:

$wpdb->prepare( 
    "
    SELECT COUNT(*)
    FROM " . $wpdb->prefix . "comments
    WHERE user_id = " . $args['user_ID'] . "
    AND comment_approved = '1'
    " 
)

First, clean it up by getting rid of the unnecessary string concatenation, and calling $wpdb->comments for the comments table:

$wpdb->prepare( 
    "
    SELECT  COUNT(*)
    FROM    $wpdb->comments
    WHERE   user_id = $args['user_ID']
    AND     comment_approved = '1'
    " 
)

Now, the warning has to do with this part of the query:

WHERE   user_id = $args['user_ID']

You need to replace $args['user_ID'] with $d, and then use $args['user_ID'] as the missing, second parameter:

$wpdb->prepare( 
    "
    SELECT  COUNT(*)
    FROM    $wpdb->comments
    WHERE   user_id = %d
    AND     comment_approved = '1'
    ",
    $args['user_ID'] // %d
)

The second one should be similar:

$wpdb->prepare( 
    "
    SELECT    COUNT(*)
    FROM      $wpdb->posts
    WHERE     post_author = %d
    AND       post_status = 'publish'
    AND       post_type = 'post'
    ",
    $args['user_ID'] // %d
)
share|improve this answer
    
Interesting. According to this article, I am calling $wpdb->prepare() with only one argument like $wpdb->prepare( "SELECT COUNT(*) FROM table" ); and I should be calling it like this: $wpdb->prepare( "SELECT * FROM table WHERE id = %d", $id );. By looking at my script, how would I make the following change? –  Christine Cooper Dec 18 '12 at 17:20
    
See updated answer. You're basically treating it as an sprintf() call to format the untrusted data. –  Chip Bennett Dec 18 '12 at 17:51
    
Excellent update. I will be adding the proposed edits and run tests to confirm if it functions accordingly. I am calling $wpdb->prepare in various places in my script, can you kindly help me detect if there are any other parts where it needs updates? The script is here: pastebin.com/Ta91zXiL Also, I plan to release this plugin publicly once I have fixed these issues and styled it better, can you please tell me how you would like to be credited for your contribution, Chip Bennett? –  Christine Cooper Dec 18 '12 at 18:18
    
"I am calling $wpdb->prepare in various places in my script, can you kindly help me detect if there are any other parts where it needs updates?" - If you have specific questions about specific instances/usages of $wpdb->prepare(), I would just ask a new question for each, as appropriate. No personal credit is necessary. :) If it were my code, I would just put an @link to this WPSE question/answer, as reference. –  Chip Bennett Dec 18 '12 at 18:21
    
You did this one well Chip, I have tested it and it works as noted. Excellent, I will be adding credit regardless as there have been various contributors to this plugin and I would like to credit everyone accordingly and thus establish a collaborative presence for whomever that actually reads credits lists ;) Upvoted and accepted. –  Christine Cooper Dec 20 '12 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.