Title: VIP hosting compatible and plugin code standards Last modified: February 1, 2018 --- # VIP hosting compatible and plugin code standards * Resolved [aosmichenko](https://wordpress.org/support/users/aosmichenko/) * (@aosmichenko) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/) * Downloads/onesignal-free-web-push-notifications » ~/www/bs/wpcs/wpcs/vendor/bin/ phpcs –standard=WordPressVIPMinimum ./* * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal- admin.php ——————————————————————————————————————————————————————- FOUND 13 ERRORS AND 77 WARNINGS AFFECTING 72 LINES ——————————————————————————————————————————————————————- 39 | WARNING | This comment is 36% valid code; is this commented out code? 43 | WARNING | This comment is 36% valid code; is this commented out code? 52 | WARNING | Unused variable $ex. 52 | WARNING | Unused variable $ex. 57 | WARNING | set_error_handler() found. Debug code should not normally be used in production. 73 | WARNING | Unused variable $ex. 73 | WARNING | Unused variable $ex. 103 | WARNING | Found: ==. Use strict comparisons (=== or !==). 112 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 114 | WARNING | This comment is 38% valid code; is this commented out code? 118 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 118 | ERROR | Detected usage of a non-sanitized input variable: $_POST 118 | ERROR | Processing form data without nonce verification. 139 | WARNING | Found: ==. Use strict comparisons (=== or !==). 148 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 157 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 172 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_transient_error’. 178 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_transient_success’. 227 | WARNING | Found: ==. Use strict comparisons (=== or !==). 231 | WARNING | Found: ==. Use strict comparisons (=== or !==). 232 | WARNING | Not using strict comparison for in_array; supply true for third argument. 243 | WARNING | Found: ==. Use strict comparisons (=== or !==). 244 | WARNING | Not using strict comparison for in_array; supply true for third argument. 250 | WARNING | Found: ==. Use strict comparisons (=== or !==). 251 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$post_type’. 253 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ $post_type’. 268 | WARNING | Unused variable $sdk_dir. 417 | WARNING | Found: ==. Use strict comparisons (=== or !==). 418 | WARNING | Found: ==. Use strict comparisons (=== or !==). 512 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 512 | ERROR | Processing form data without nonce verification. 515 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 515 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 515 | ERROR | Detected usage of a non-validated input variable: $_POST 515 | ERROR | Processing form data without nonce verification. 515 | WARNING | Found: ==. Use strict comparisons( === or !==). 517 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 517 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 517 | ERROR | Detected usage of a non- validated input variable: $_POST 517 | ERROR | Processing form data without nonce verification. 517 | WARNING | Found: ==. Use strict comparisons (=== or !==). 520 | WARNING | Found: ==. Use strict comparisons (=== or !==). 522 | WARNING | Found: ==. Use strict comparisons (=== or !==). 541 | WARNING | Found: ==. Use strict comparisons (=== or !==). 541 | WARNING | Not using strict comparison for in_array; supply true for third argument. 579 | WARNING | Found: ==. Use strict comparisons (=== or !==). 579 | WARNING | Not using strict comparison for in_array; supply true for third argument. 598 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 598 | ERROR | Processing form data without nonce verification. 599 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 602 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 602 | ERROR | Processing form data without nonce verification. 603 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 612 | WARNING | Found: !=. Use strict comparisons (=== or !==). 638 | WARNING | Found: ==. Use strict comparisons (=== or !==). 657 | WARNING | Found: ==. Use strict comparisons( === or !==). 659 | WARNING | Found: ==. Use strict comparisons (=== or !==). 685 | WARNING | Found: ==. Use strict comparisons (=== or !==). 693 | WARNING | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen() 697 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 707 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 708 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 712 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 713 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 714 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 715 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 715 | WARNING | json_encode() is discouraged. Use wp_json_encode() instead. 716 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 720 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 724 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 725 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 726 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 727 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 730 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 732 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 734 | WARNING | Found: !=. Use strict comparisons( === or !==). 735 | WARNING | Found: !=. Use strict comparisons (=== or !==). 738 | WARNING | print_r() found. Debug code should not normally be used in production. 755 | WARNING | Found: ==. Use strict comparisons (=== or !==). 758 | WARNING | Found: !=. Use strict comparisons (=== or !==). 772 | WARNING | File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose() 775 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 776 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 781 | WARNING | Found: !=. Use strict comparisons (=== or !==). 783 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 784 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 785 | WARNING | print_r() found. Debug code should not normally be used in production. 789 | WARNING | Using cURL functions is highly discouraged. Use wp_remote_get() instead. 806 | WARNING | Found: ==. Use strict comparisons (= == or !==). 830 | WARNING | Found: ==. Use strict comparisons (=== or !==). ——————————————————————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal- public.php ——————————————————————————————————————————————————————- FOUND 58 ERRORS AND 61 WARNINGS AFFECTING 118 LINES ——————————————————————————————————————————————————————- 11 | WARNING | debug_backtrace() found. Debug code should not normally be used in production. 19 | WARNING | var_export() found. Debug code should not normally be used in production. 33 | ERROR | error_log() found. Debug code should not normally be used in production. 75 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$custom_manifest_url’. 80 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$current_plugin_url’. 80 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$gcm_sender_id’. 95 | WARNING | Found: ==. Use strict comparisons (=== or !==). 107 | ERROR | Scripts must be registered/enqueued via wp_enqueue_script 109 | ERROR | Scripts must be registered/enqueued via wp_enqueue_script 123 | WARNING | Found: !=. Use strict comparisons (=== or !==). 124 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 127 | WARNING | Found:! =. Use strict comparisons (=== or !==). 128 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 131 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 139 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 141 | WARNING | Found: ==. Use strict comparisons( === or !==). 148 | WARNING | Found: ==. Use strict comparisons (=== or !==). 152 | WARNING | Found: ==. Use strict comparisons (=== or !==). 153 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 154 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 155 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 159 | WARNING | Found: ==. Use strict comparisons (=== or !==). 161 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 162 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 163 | WARNING | Found: !=. Use strict comparisons (=== or !==). 164 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 172 | WARNING | Found: !=. Use strict comparisons (== = or !==). 173 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 176 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$current_plugin_url’. 179 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 180 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 183 | WARNING | Found: ==. Use strict comparisons (=== or !==). 186 | WARNING | Found: ==. Use strict comparisons (=== or !==). 191 | WARNING | Found: ==. Use strict comparisons (=== or !==). 192 | WARNING | Found: !=. Use strict comparisons ( === or !==). 193 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 195 | WARNING | Found: !=. Use strict comparisons (=== or !==). 196 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 198 | WARNING | Found: !=. Use strict comparisons (=== or !==). 199 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 201 | WARNING | Found: !=. Use strict comparisons (=== or !==). 202 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 204 | WARNING | Found: !=. Use strict comparisons (== = or !==). 205 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 207 | WARNING | Found: !=. Use strict comparisons (=== or !==). 208 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 210 | WARNING | Found: !=. Use strict comparisons (=== or !==). 211 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 213 | WARNING | Found: !=. Use strict comparisons (=== or !==). 214 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 216 | WARNING | Found: !=. Use strict comparisons (== = or !==). 217 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 219 | WARNING | Found: !=. Use strict comparisons (=== or !==). 220 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 224 | WARNING | Found: ==. Use strict comparisons (=== or !==). 229 | WARNING | Found: !=. Use strict comparisons (=== or !==). 230 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 232 | WARNING | Found: !=. Use strict comparisons( === or !==). 233 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 235 | WARNING | Found: !=. Use strict comparisons (== = or !==). 236 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 239 | WARNING | Found: ==. Use strict comparisons (== = or !==). 254 | WARNING | Found: ==. Use strict comparisons (=== or !==). 258 | WARNING | Found: ==. Use strict comparisons (=== or !==). 264 | WARNING | Found: ==. Use strict comparisons (=== or !==). 266 | WARNING | Found: !=. Use strict comparisons (=== or !==). 267 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ OneSignalUtils’. 269 | WARNING | Found: !=. Use strict comparisons (=== or != =). 270 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 272 | WARNING | Found: !=. Use strict comparisons (=== or !==). 273 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 275 | WARNING | Found: !=. Use strict comparisons (=== or !==). 276 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 278 | WARNING | Found: !=. Use strict comparisons (=== or !==). 279 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 281 | WARNING | Found: !=. Use strict comparisons (== = or !==). 282 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 284 | WARNING | Found: !=. Use strict comparisons (=== or !==). 285 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 287 | WARNING | Found: !=. Use strict comparisons (=== or !==). 288 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 290 | WARNING | Found: !=. Use strict comparisons (=== or !==). 291 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 293 | WARNING | Found: !=. Use strict comparisons (== = or !==). 294 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 296 | WARNING | Found: !=. Use strict comparisons (=== or !==). 297 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 299 | WARNING | Found: !=. Use strict comparisons (=== or !==). 300 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 304 | WARNING | Found: ==. Use strict comparisons (=== or !==). 306 | WARNING | Found: !=. Use strict comparisons( === or !==). 307 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 309 | WARNING | Found: !=. Use strict comparisons (== = or !==). 310 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 312 | WARNING | Found: !=. Use strict comparisons (== = or !==). 313 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 315 | WARNING | Found: !=. Use strict comparisons (== = or !==). 316 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 318 | WARNING | Found: !=. Use strict comparisons (== = or !==). 319 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 321 | WARNING | Found: !=. Use strict comparisons (== = or !==). 322 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 324 | WARNING | Found: !=. Use strict comparisons (== = or !==). 325 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 327 | WARNING | Found: !=. Use strict comparisons (== = or !==). 328 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 330 | WARNING | Found: !=. Use strict comparisons (== = or !==). 331 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 333 | WARNING | Found: !=. Use strict comparisons (== = or !==). 334 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘$ onesignal_wp_settings’. 338 | WARNING | Found: ==. Use strict comparisons (== = or !==). 340 | WARNING | Found: !=. Use strict comparisons (=== or !==). 341 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 343 | WARNING | Found: !=. Use strict comparisons (=== or !==). 344 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 346 | WARNING | Found: !=. Use strict comparisons (=== or !==). 347 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 368 | WARNING | Found: ==. Use strict comparisons (=== or !==). 392 | WARNING | Found: ==. Use strict comparisons (=== or !==). ——————————————————————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal- settings.php ———————————————————————————————– FOUND 1 ERROR AND 3 WARNINGS AFFECTING 4 LINES ———————————————————————————————– 111 | WARNING | [ ] Variable $onesignal_wp_settings is undefined. 122 | WARNING | [ ] Assignment found within a condition. Did you mean to do a comparison? 253 | WARNING | [ ] Found: ==. Use strict comparisons( === or !==). 274 | ERROR | [x] A closing tag is not permitted at the end of a PHP file ———————————————————————————————– PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY ———————————————————————————————– * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal- utils.php —————————————————————————————————- FOUND 3 ERRORS AND 2 WARNINGS AFFECTING 3 LINES —————————————————————————————————- 25 | WARNING | [ ] Detected access of super global var $_SERVER, probably needs manual inspection. 26 | WARNING | [ ] Detected access of super global var $_SERVER, probably needs manual inspection. 26 | ERROR | [ ] Detected usage of a non-validated input variable: $_SERVER 26 | ERROR | [ ] Detected usage of a non-sanitized input variable: $_SERVER 69 | ERROR | [x] A closing tag is not permitted at the end of a PHP file —————————————————————————————————- PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY —————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal- widget.php ————————————————————————————————————————————————————- FOUND 16 ERRORS AFFECTING 10 LINES ————————————————————————————————————————————————————- 17 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 17 | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found ‘_e’. 18 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 18 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 19 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 19 | ERROR | All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found ‘_e’. 20 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 20 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$this’. 27 | ERROR | strip_tags does not strip CSS and JS in between the script and style tags. `wp_strip_all_tags` should be used instead. 28 | ERROR | strip_tags does not strip CSS and JS in between the script and style tags. `wp_strip_all_tags` should be used instead. 35 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$args’. 37 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$args’. 37 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘apply_filters’. 37 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$args’. 40 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$instance’. 42 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$args’. ————————————————————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/onesignal. php ————————————————————————————– FOUND 1 ERROR AFFECTING 1 LINE ————————————————————————————– 36 | ERROR | [x] A closing tag is not permitted at the end of a PHP file ————————————————————————————– PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY ————————————————————————————– * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/sdk_files/ manifest.json.php —————————————————————————————————————————————————————- FOUND 3 ERRORS AND 2 WARNINGS AFFECTING 2 LINES —————————————————————————————————————————————————————- 9 | WARNING | Detected access of super global var $_GET, probably needs manual inspection. 9 | WARNING | Processing form data without nonce verification. 9 | ERROR | Detected usage of a non-validated input variable: $_GET 9 | ERROR | Detected usage of a non-sanitized input variable: $_GET 13 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘$gcm_sender_id’. —————————————————————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/sdk_files/ OneSignalSDKUpdaterWorker.js.php ——————————————————————————————————————- FOUND 1 ERROR AFFECTING 1 LINE ——————————————————————————————————————- 15 | ERROR |[ x] A closing tag is not permitted at the end of a PHP file ——————————————————————————————————————- PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY ——————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/sdk_files/ OneSignalSDKWorker.js.php ———————————————————————————————————— FOUND 1 ERROR AFFECTING 1 LINE ———————————————————————————————————— 15 | ERROR | [x] A closing tag is not permitted at the end of a PHP file ———————————————————————————————————— PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY ———————————————————————————————————— * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ config.php ——————————————————————————————————————————————————————- FOUND 125 ERRORS AND 12 WARNINGS AFFECTING 91 LINES ——————————————————————————————————————————————————————- 11 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 11 | ERROR | Processing form data without nonce verification. 14 | WARNING | Detected access of super global var $_POST, probably needs manual inspection. 92 | ERROR | All output should be run through an escaping function( see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 95 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 109 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 112 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 157 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 165 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 168 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 193 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 216 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 229 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 233 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 235 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 237 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 239 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 241 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 243 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 264 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 264 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 265 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 284 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 289 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 293 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 297 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘$onesignal_wp_settings’. 302 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 302 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 351 | WARNING | Found: ==. Use strict comparisons (=== or !==). 360 | WARNING | Found: ==. Use strict comparisons (=== or !==). 369 | WARNING | Found: ==. Use strict comparisons (=== or !==). 378 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 378 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 378 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 394 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 417 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 422 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 446 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 452 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 453 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 458 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 464 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 470 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 476 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 483 | WARNING | Found: ==. Use strict comparisons (=== or !==). 484 | WARNING | Found: ==. Use strict comparisons (=== or !==). 485 | WARNING | Found: ==. Use strict comparisons (=== or !==). 491 | WARNING | Found: ==. Use strict comparisons ( === or !==). 492 | WARNING | Found: ==. Use strict comparisons (=== or !==). 498 | WARNING | Found: ==. Use strict comparisons (=== or !==). 499 | WARNING | Found: ==. Use strict comparisons (=== or !==). 511 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 511 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 515 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 515 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 519 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 519 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 532 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ @’. 532 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 536 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 536 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 540 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 540 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 544 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 544 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 548 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ @’. 548 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 552 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 552 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 556 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 556 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 560 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 560 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 564 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ @’. 564 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 568 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 568 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 580 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 580 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 584 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 584 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 588 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 588 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 592 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 592 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 596 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 596 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 600 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 600 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 604 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 604 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 608 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 608 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 612 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 612 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 616 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 616 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 620 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 620 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 624 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 624 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 635 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 640 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 646 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ OneSignalUtils’. 646 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 650 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 650 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 654 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 654 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 658 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 658 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 662 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 662 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 666 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 666 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 670 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 670 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 674 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 674 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 678 | ERROR | All output should be run through an escaping function ( see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 678 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 682 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 682 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 693 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found | | ‘ONESIGNAL_PLUGIN_URL’. 705 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 705 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 709 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ OneSignalUtils’. 709 | ERROR | The code shouldn’t use error control operators( @). The call should be wrapped in appropriate checks. 713 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 713 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 731 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 745 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘OneSignalUtils’. 745 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 757 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found ‘@’. 757 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. 769 | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found‘ @’. 769 | ERROR | The code shouldn’t use error control operators (@). The call should be wrapped in appropriate checks. ——————————————————————————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ css/icons.css ——————————————————————————————– FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ——————————————————————————————– 1 | WARNING | File appears to be minified and cannot be processed ——————————————————————————————– * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ css/lusitana.css ———————————————————————————————– FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ———————————————————————————————– 1 | WARNING | File appears to be minified and cannot be processed ———————————————————————————————– * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ css/onesignal-menu-styles.css ———————————————————————————————————— FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ———————————————————————————————————— 1 | WARNING | File appears to be minified and cannot be processed ———————————————————————————————————— * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ css/semantic-ui.css ————————————————————————————————– FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ————————————————————————————————– 1 | WARNING | File appears to be minified and cannot be processed ————————————————————————————————– * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ css/site.css ——————————————————————————————- FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ——————————————————————————————- 1 | WARNING | File appears to be minified and cannot be processed ——————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ javascript/jquery.min.js ——————————————————————————————————- FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ——————————————————————————————————- 1 | WARNING | File appears to be minified and cannot be processed ——————————————————————————————————- * FILE: /Users/aosmichenko/Downloads/onesignal-free-web-push-notifications/views/ javascript/semantic-ui.js ——————————————————————————————————– FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE ——————————————————————————————————– 1 | WARNING | File appears to be minified and cannot be processed ——————————————————————————————————– Viewing 6 replies - 1 through 6 (of 6 total) * [Aleksei](https://wordpress.org/support/users/stormman/) * (@stormman) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9940181) * Hi, * Looks like your web server is misconfigured. Better to check it with your host provider. And what is the “VIP hosting” thing exactly? Sounds really strange. * Thread Starter [aosmichenko](https://wordpress.org/support/users/aosmichenko/) * (@aosmichenko) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9940224) * Hello, * Here is VIP hosting [https://vip.wordpress.com/](https://vip.wordpress.com/) it is provided by Automattic the company behind WordPress core. They are strictly following WordPress coding standards and the report I sent you are issues in your code according to this standards. if you can fix it that would be great and many people who are using your plugin would be able to use it on the WordPress VIP hosting. * Thanks, Alex * [Aleksei](https://wordpress.org/support/users/stormman/) * (@stormman) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9940280) * Hi Alex, this is interesting. I hope the developers will see the message and answer your request, as it seems to be very important and strange simultaneously– such a long list of errors on an official WP hosting. It is just not right. What is more strange, on my old web server I don’t have any of these errors and warnings. * P.s. I’m not a developer and I’m sorry if I made you think I was one. * Thread Starter [aosmichenko](https://wordpress.org/support/users/aosmichenko/) * (@aosmichenko) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9940293) * This is not PHP errors, this is report from Code Sniffer, developer will understand what it is. * [Aleksei](https://wordpress.org/support/users/stormman/) * (@stormman) * [8 years, 4 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9940315) * Ok, got it. * Plugin Author [OneSignal Push Notifications](https://wordpress.org/support/users/onesignal/) * (@onesignal) * [8 years, 3 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9978711) * Hi [@aosmichenko](https://wordpress.org/support/users/aosmichenko/), * At this time, our plugin isn’t compatible with WordPress VIP hosting, but if you reach out to us at [support@onesignal.com](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/support@onesignal.com?output_format=md), we can set you up with an alternative workaround. Viewing 6 replies - 1 through 6 (of 6 total) The topic ‘VIP hosting compatible and plugin code standards’ is closed to new replies. * ![](https://ps.w.org/onesignal-free-web-push-notifications/assets/icon.svg?rev =3003897) * [OneSignal - Web Push Notifications](https://wordpress.org/plugins/onesignal-free-web-push-notifications/) * [Frequently Asked Questions](https://wordpress.org/plugins/onesignal-free-web-push-notifications/#faq) * [Support Threads](https://wordpress.org/support/plugin/onesignal-free-web-push-notifications/) * [Active Topics](https://wordpress.org/support/plugin/onesignal-free-web-push-notifications/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/onesignal-free-web-push-notifications/unresolved/) * [Reviews](https://wordpress.org/support/plugin/onesignal-free-web-push-notifications/reviews/) * 6 replies * 3 participants * Last reply from: [OneSignal Push Notifications](https://wordpress.org/support/users/onesignal/) * Last activity: [8 years, 3 months ago](https://wordpress.org/support/topic/vip-hosting-compatible-and-plugin-code-standards/#post-9978711) * Status: resolved