Title: sql – Make WordPress Core

---

#  Tag Archives: sql

 [  ](https://profiles.wordpress.org/nacin/) [Andrew Nacin](https://profiles.wordpress.org/nacin/)
6:14 am _on_ December 12, 2012     
Tags: [3.5 ( 27 )](https://make.wordpress.org/core/tag/3-5/),
[dev-notes ( 621 )](https://make.wordpress.org/core/tag/dev-notes/), sql, [wpdb ( 6 )](https://make.wordpress.org/core/tag/wpdb/)

# 󠀁[PHP Warning: Missing argument 2 for wpdb::prepare()](https://make.wordpress.org/core/2012/12/12/php-warning-missing-argument-2-for-wpdb-prepare/)󠁿

Hello pluginPlugin A plugin is a piece of software containing a group of functions
that can be added to a WordPress website. They can extend functionality or add new
features to your WordPress websites. WordPress plugins are written in the PHP programming
language and integrate seamlessly with WordPress. These can be free in the WordPress.
org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/)
or can be cost-based plugin from a third-party. or theme author! You possibly found
this post after searching the Internet for the error above: “PHPPHP The web scripting
language in which WordPress is primarily architected. WordPress requires PHP 7.4
or higher Warning: Missing argument 2 for wpdb::prepare().”

So, this is a new warning in 3.5. **No sites are broken,** everything is fine as
before. But, this is indeed something you need to look at, because you may be exposing
your users to a possible SQL injection vulnerability. Now that’s no fun!

First, if you’re a user and you want to get rid of these errors, you should turn
off the displaying of errors in PHP. There are many ways to do this, such as in 
php.ini, .htaccess, etc. For this, you can just put this in wp-config.php. (Note
that hiding errors on production sites is good practice anyway.)

    ```notranslate
    @ini_set('display_errors', 0);
    ```

If you’re a user, you can stop here. **(If you need more help, please don’t comment
here, try the helpful [Support Forums](https://wordpress.org/support/).)** Just 
be sure to send a link to this post to the developer of the theme or plugin referenced
in the error.

Now, developers: Here’s how $wpdb->prepare() is supposed to work:

    ```notranslate
    $wpdb->prepare( "SELECT * FROM table WHERE ID = %d AND name = %s", $id, $name );
    ```

See how $id — an integer, presumably — was passed as the second argument? That corresponds
to the first placeholder, %d. Then, $name (a string) was passed as the third argument,
thus the second placeholder, %s. This makes sure your query is safe, and prevents
something like [little bobby tables](http://xkcd.com/327/). (Note: the comic is 
wrong, don’t sanitize — always prepare your queries.)

The problem is, a number of people were calling $wpdb->prepare() with only one argument,
like so:

    ```notranslate
    $wpdb->prepare( "SELECT COUNT(*) FROM table" );
    ```

See, there’s no parameter (%d, %s, or for floats, %f) in this query. This happens
to work fine, but the prepare call isn’t doing anything. You should instead the 
query directly, as there are no inputs.

But here’s where the problem lies:

    ```notranslate
    $wpdb->prepare( "SELECT * FROM table WHERE id = $id" );
    ```

See the problem? That query isn’t secure! You may think you are “preparing” this
query, but you’re not — you’re passing $id directly into the query, unprepared. 
And **this**, right here, is why $wpdb->prepare() now issues a warning if it isn’t
called with more than one argument. Because you can’t prepare a query without more
than one argument. Here’s a correct example:

    ```notranslate
    $wpdb->prepare( "SELECT * FROM table WHERE id = %d", $id );
    ```

This wasn’t a decision done lightly. We don’t like shoving PHP warnings into the
faces of users and developers. But given the potential security risks, we wanted
everyone to immediately look at how they are running queries. And, of course, always
prepare them properly.

For more: [wpdb Codex reference](https://codex.wordpress.org/Class_Reference/wpdb),
[#22262](https://core.trac.wordpress.org/ticket/22262), and [[22429]](https://core.trac.wordpress.org/changeset/22429).

[#3-5](https://make.wordpress.org/core/tag/3-5/), [#dev-notes](https://make.wordpress.org/core/tag/dev-notes/),
[#sql](https://make.wordpress.org/core/tag/sql/), [#wpdb](https://make.wordpress.org/core/tag/wpdb/)