Incorrect Use of wpdb::prepare()

Question

Not sure what I am doing wrong here. I did not write this code however I am receiving the following error in WordPress:

The query argument of wpdb::prepare() must have a placeholder. This message was added in version 3.9.

<?php

        echo '<div class="client_list"><input type="checkbox" name="check_all" value="0" class="" id="check_all" /> Check All</div>';


        $send_message_lists = get_post_meta($post->ID, wpvbxcon::smslist_smsclient, true);
        if(!is_array($send_message_lists))
            $send_message_lists = array();
        //print_r($send_message_lists);
        foreach($lists as $list)
            {   

                $q = "SELECT COUNT(*) FROM $wpdb->postmeta m JOIN $wpdb->posts p ON p.ID = m.post_id WHERE meta_key = '_wpvbx_subscription' AND meta_value = $list->ID AND post_status = 'publish';";
                $subscriber_count = $wpdb->get_var($wpdb->prepare($q));

                $checked = '';
                if(in_array($list->ID, $send_message_lists))
                    $checked = 'checked="checked"';

                if( current_user_can( '_wpvbx_access_list_'.$list->ID ) || current_user_can('administrator') )
                    printf('<div class="client_list"><input type="checkbox" name="lists[]" value="%d" class="list" %s /> %s (%d)</div>', $list->ID, $checked, $list->post_title, $subscriber_count);
            }
        echo '<div style="clear:both;"> </div>';


        ?>    

Answer 1

You should try to replace the meta_value = $list->ID part with the placeholder meta_value = %d. Then use the following:

$subscriber_count = $wpdb->get_var( $wpdb->prepare( $q, $list->ID ) );

where the input argument $list->ID will be treated as an integer (signed).

From the Codex:

The query parameter for prepare accepts sprintf()-like placeholders. The %s (string), %d (integer) and %f (float) formats are supported. (The %s and %d placeholders have been available since the function was added to core in Version 2.3, %f has only been available since Version 3.3.) Any other % characters may cause parsing errors unless they are escaped. All % characters inside SQL string literals, including LIKE wildcards, must be double-% escaped as %%. All of %d, %f, and %s are to be left unquoted in the query string. Note that the %d placeholder only accepts integers, so you can't pass numbers that have comma values via %d. If you need comma values, use %f as float instead.