0

I'm having to update a WP installation for a community organisations from version 2.9.1 to the current 3.9.1.

The installation has a couple of custom built plugins that aren't documented.

I've just performed the WP version update and now I see a warning (Missing argument 2 for wpdb::prepare()) on every page that relates to the following line in the code of one of these custom built plugin:

$rows = $wpdb->get_results($wpdb->prepare("SELECT id, name FROM ".$table_name));

From what I've read online, this is due to a change in the coding, that requires 2 values to be sent to wpdb::prepare(), but I've no idea how the line of code given above, needs to be changed.

If someone could help me out, I'd really appreciate it.

0

That was not exactly change in code, that was change to better inform people they are not using the method correctly.

In line with wpdb documentation you need to properly pass values, or they won't be properly escaped in query.

In your case it would turn into something like:

$wpdb->prepare("SELECT id, name FROM %s", $table_name)

Note that if $table_name isn't coming from any untrusted input, then there is no need to prepare query in such case altogether.

  • Ive change the line in question to: $rows = $wpdb->get_results($wpdb->prepare("SELECT id, name FROM %s", $table_name)); But now it doesnt appear to be pukking out any results. – Phill Healey Aug 6 '14 at 11:43
  • @PhillHealey that's probably because it's table name and not just a string, quotes issues, etc. As per answer unless table name somehow comes from untrusted source you don't need to prepare/escape it in first place. – Rarst Aug 6 '14 at 11:57
  • So an 'unprepared' statement would look like.... $rows = $wpdb->get_results("SELECT id, name FROM ".$table_name); ??? – Phill Healey Aug 6 '14 at 12:02
  • That seems to be working. anyway. – Phill Healey Aug 6 '14 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.