0

Not sure what I am doing wrong here. I did not write this code however I am receiving the following error in WordPress:

The query argument of wpdb::prepare() must have a placeholder. This message was added in version 3.9.

<?php

        echo '<div class="client_list"><input type="checkbox" name="check_all" value="0" class="" id="check_all" /> Check All</div>';


        $send_message_lists = get_post_meta($post->ID, wpvbxcon::smslist_smsclient, true);
        if(!is_array($send_message_lists))
            $send_message_lists = array();
        //print_r($send_message_lists);
        foreach($lists as $list)
            {   

                $q = "SELECT COUNT(*) FROM $wpdb->postmeta m JOIN $wpdb->posts p ON p.ID = m.post_id WHERE meta_key = '_wpvbx_subscription' AND meta_value = $list->ID AND post_status = 'publish';";
                $subscriber_count = $wpdb->get_var($wpdb->prepare($q));

                $checked = '';
                if(in_array($list->ID, $send_message_lists))
                    $checked = 'checked="checked"';

                if( current_user_can( '_wpvbx_access_list_'.$list->ID ) || current_user_can('administrator') )
                    printf('<div class="client_list"><input type="checkbox" name="lists[]" value="%d" class="list" %s /> %s (%d)</div>', $list->ID, $checked, $list->post_title, $subscriber_count);
            }
        echo '<div style="clear:both;"> </div>';


        ?>    
1

You should try to replace the meta_value = $list->ID part with the placeholder meta_value = %d. Then use the following:

$subscriber_count = $wpdb->get_var( $wpdb->prepare( $q, $list->ID ) );

where the input argument $list->ID will be treated as an integer (signed).

From the Codex:

The query parameter for prepare accepts sprintf()-like placeholders. The %s (string), %d (integer) and %f (float) formats are supported. (The %s and %d placeholders have been available since the function was added to core in Version 2.3, %f has only been available since Version 3.3.) Any other % characters may cause parsing errors unless they are escaped. All % characters inside SQL string literals, including LIKE wildcards, must be double-% escaped as %%. All of %d, %f, and %s are to be left unquoted in the query string. Note that the %d placeholder only accepts integers, so you can't pass numbers that have comma values via %d. If you need comma values, use %f as float instead.

  • Thank you for the quick response. I have made the suggested changes however this appears to have slightly broken the page. Now when going to the page to create a new message, all metaboxes do not fully load and dashboard menu items with submenus do not appear. – user50733 Oct 15 '14 at 0:31
  • That most likely means you got an error in the PHP syntax. Always take a backup before changing anything. What does the current version look like? – birgire Oct 15 '14 at 3:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.