SQL Errors from templates

[Karen Thomas]

Hello,

Ben from WCVendors has informed me I have lots of SQL errors on my site. He has asked me to tell you to download https://www.consciouscrafties.com/sm.txt so you can view the errors your templates are generating and fix them.

Please can you confirm you are going to fix these please?

Thank you,

Karen

[Varun Dubey]

Hi @conscious-crafties,

Thanks for your input, I have notified developers on high priority to fix them.

Regards
Varun Dubey

[Varun Dubey]

Hi @conscious-crafties, It seems it was WC vendor issue.

WCVendors PRO use this syntax:

    $feedback = $wpdb->get_results(
        "
        SELECT * FROM $table_name
        WHERE order_id = $order_id
        "
    ); 

its not safe syntax.
This is better:

$feedback = $wpdb->get_results( $wpdb->prepare(
"
SELECT * FROM %s
WHERE order_id = %s
",
$table_name,
$order_id
) );

We will notifiy them to get fixed in coming updates.
Regards
Varun Dubey

[Karen Thomas]

OK thanks @vapvarun 🙂

[Varun Dubey]

I will close this thread, Feel free create new topic for any further concern.

Regards
Varun Dubey