1

So I have been using the theme Vilan from ThemeForest. Along with the theme come a couple of plugins, of which one is Revolution Slider. I'm also using Bedrock by Roots. I'm getting the following error:

Notice: wpdb::prepare was called incorrectly. The query argument of wpdb::prepare() must have a placeholder. Please see Debugging in WordPress for more information. (This message was added in version 3.9.) in /Applications/MAMP/htdocs/localppl/web/wp/wp-includes/functions.php on line 3547.

It wouldn't bother me except that the WordPress Gallery gets stuck on loading whenever displaying on grid mode. I found out the error is coming from Revolution slider, because I turned it off and on and the problem would appear and disappear whenever I did so. I tried to track back the problem and I found it would work fine once I removed the code below. Now, I'm sure the problem is with the database call, but I don't know how to fix it (I'll use a child theme to replace the filter).

It works fine once I remove the prepare call, but I read that it is used to prevent SQL injections. Even if, I still want to learn how to fix this while using it, if possible.

 if (is_plugin_active('revslider/revslider.php')) {
 global $wpdb;

  $rs_table_name = $wpdb->prefix . "revslider_sliders";
  $rs = $wpdb->get_results( $wpdb->prepare("SELECT id, title, alias FROM $rs_table_name ORDER BY id ASC LIMIT 999", '') );

 $revsliders = array();
 if ($rs) {
     foreach ( $rs as $slider ) {
       $revsliders[$slider->alias] = $slider->alias;
     }
 } else {
     $revsliders["No sliders found"] = 0;
 }

 // Page header slideshow metabox
 $meta_boxes[] = array(
         // Meta box id, UNIQUE per meta box. Optional since 4.1.5
         'id' => 'general_page_header_slideshow_meta',

         // Meta box title - Will appear at the drag and drop handle bar. Required.
         'title' => __( 'Page Header Slideshow', 'okthemes' ),

         // Post types, accept custom post types as well - DEFAULT is array('post'). Optional.
         'pages' => array( 'page' ),

         // Where the meta box appear: normal (default), advanced, side. Optional.
         'context' => 'normal',

         // Order of meta box: high (default), low. Optional.
         'priority' => 'high',

         // Auto save: true, false (default). Optional.
         'autosave' => true,

         // List of meta fields
         'fields' => array(
                 array(
                     'name'  => 'Page header slider',
                     'id'    => "{$prefix}page_header_slider",
                     'desc'  => 'Enable/Disable page header slider.',
                     'std'   => 0,
                     'type'  => 'checkbox',
                 ),

                 // SELECT BOX
                 array(
                     'name'     => __( 'Select the page header slider', 'okthemes' ),
                     'id'       => "{$prefix}page_header_slider_select",
                     'type'     => 'select',
                     // Array of 'value' => 'Label' pairs for select box
                     'options'  => $revsliders,
                     // Select multiple values, optional. Default is false.
                     'multiple'    => false,
                     'std'         => '',
                     'placeholder' => __( 'Select a slider', 'okthemes' ),
                 ),

         ),

 );
 } //end check for rev slider
3
  • 3
    you can just remove prepare. a query isn't injectable if it doesn't take any input, there are no arguments to prepare.
    – Milo
    Commented Mar 8, 2015 at 17:27
  • @Milo Can you please elaborate on why I'm getting the error? Is it simply because there aren't any arguments to prepare? How would I be able to accomplish this with prepare, if possible? What's the error?
    – yaserso
    Commented Mar 8, 2015 at 17:29
  • 3
    the error message explains what the problem is- the query should have a placeholder that gets replaced with the second argument. read the section in docs about prepare to understand its purpose. there's nothing to replace, so there is no correct way to write that query with prepare.
    – Milo
    Commented Mar 8, 2015 at 17:35

1 Answer 1

2

As per suggestion by Milo, I removed the prepare statement, and it worked beautifully:

$rs = $wpdb->get_results( "SELECT id, title, alias FROM $rs_table_name ORDER BY id ASC LIMIT 999" );

I then came to try and overwrite it through a child theme. It was being added to a filter originally in the parent theme:

add_filter( 'rwmb_meta_boxes', 'gg_register_meta_boxes' );

I struggled as to how I could replace the filter; a simple remove and add of another function didn't solve it, but I had to add the remove_filter to an action hook in order to overwrite the parent theme functions: after_setup_theme.

I solved that through the following code:

// Change Parent Theme Features
add_action( 'after_setup_theme', 'change_parent_theme_features', 10 );

function change_parent_theme_features() {
    remove_filter( 'rwmb_meta_boxes', 'gg_register_meta_boxes' );
}

Finally, I added the amended function to the above filter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.