Possible Duplicate:
$wpdb->prepare() warning in WordPress 3.5

Im facing with a error after updated Wordpress to 3.5, Im aware of error but I cant fix it.

This is code:

 $wpdb->prepare("INSERT INTO $orders_table ( theme_name, user_id, order_status, order_verified, order_date, order_payment_method, order_ip  )VALUES ( %s,  %d,  %d,  %d,  %s,  %s, %s)",$theme_name, $user_id, $order_status, $order_verified, $date_now, $order_payment_method, $ip)

$wpdb->prepare("SELECT COUNT(*) FROM $orders_table where theme_name='$theme_name' && order_verified = '1';")

$wpdb->prepare("SELECT COUNT(*) FROM $orders_table where theme_name='$theme_name' && order_verified = '1' && DAY(order_date) = '$fa_today' && MONTH(order_date) = '$fa_this_month' && YEAR(order_date) = '$fa_this_year';")

Can someone please update code above?



Because you're missing second argument, for more information see this post - http://make.wordpress.org/core/2012/12/12/php-warning-missing-argument-2-for-wpdb-prepare/.

Also you're doing it wrong, for security reason you shouldn't pass variables into query directly that's why you should use prepare() method - see Codex for usage info.

  • Mamaduka, thanks for your answer. But im not able to edit the code, if i do i get errors. can you help me on this?
    – user24903
    Dec 16 '12 at 14:51
  • Why aren't you able to edit the code?
    – Mamaduka
    Dec 16 '12 at 14:54

You should pass the variables (theme_name and user_id) in that string as parameters, and use %s and %d as place holder from them like it is done in the sprintf kind of functions.

$wpdb->prepare("SELECT order_id FROM $orders_table WHERE theme_name='%s' && user_id='%d' && order_status='0' && order_verified ='0' ",$theme_name,$user_id)
  • thanks you Mark, i appreciate it, lost all day wasnt able to fix. i have 3 more codes actually.
    – user24903
    Dec 16 '12 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.