David Perez

We have moved this check to a warning status, as we are working on improving the AI to reduce the number of false positives. Until this enhancement is implemented, we don’t envisage any other solutions.

Hello,

The issue is that Plugin Check (PCP) requires prepared statements to be passed directly to the database method – it doesn’t recognize them when stored in a variable first.

The correct solution:

Pass the prepared statement directly to get_results():

$table = $wpdb->prefix . '_visitors';
$t4    = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM %i WHERE date = %s ORDER BY n DESC",
        $table,
        $custom_day
    )
);

This is the only way PCP will accept it. You cannot:

• Store the query in a variable first
• Use ignore comments (PCP doesn’t allow them)

Additional notes:

• Make sure you’re using %i for identifiers (table/column names) – requires WordPress 6.2+
• Use %s, %d, or %f for values
• Column names like date and n are correctly hardcoded in your query

This pattern ensures PCP can verify your code is properly using prepared statements.

Regards

• This reply was modified 3 months, 3 weeks ago by David Perez.

Hello Jose,

We are actively developing PCP, but it is not always easy to refine the checks. That’s why we’ve moved it to a warning for now, while we look for a better solution. It won’t be a quick solution.

This plugin is a community project, so if you think you can improve it, please do!

Here is the repository: https://github.com/WordPress/plugin-check.

Hello,

They are not false positive as we are asking authors to ensure that their php file is not called directly.

Where is that function? is it global? You need to share all context.