MySQL Warning after upgrade to 4.3

I am also seeing these warnings (could be related to WP 4.0, or specific php and MySQL versions)…I’m not seeing these warnings on some hosts where I have sites hosted…looks like the mysql_real_escape_string function expects two parameters, but it’s only getting one. Anyone have any ideas?

Here are the warning messages:

Warning: mysql_real_escape_string(): Access denied for user ‘xxxxx’@’localhost’ (using password: NO) in /wp-content/plugins/sb-child-list/sb_child_list.php on line 219

Warning: mysql_real_escape_string(): A link to the server could not be established in /wp-content/plugins/sb-child-list/sb_child_list.php on line 219

Warning: mysql_real_escape_string(): Access denied for user ‘xxxxx’@’localhost’ (using password: NO) in /wp-content/plugins/sb-child-list/sb_child_list.php on line 220

Warning: mysql_real_escape_string(): A link to the server could not be established in /wp-content/plugins/sb-child-list/sb_child_list.php on line 220

This plugin needs to be updated. Replace mysql_real_escape_string() with esc_sql().

Hi, I have same problem with the Access Denied error message in the log.
Did the Replace suggested by GrassJockey work?

Looking at the plugin’s PHP file now, should every instance of mysql_real_escape_string() be replaced by esc_sql() or only certain lines?

Is this this part of the PHP which tries to access the wp database?

—————————-

function sb_cl_get_cat_id_from_name($cat) {
        global $wpdb;

        $sql = 'SELECT term_id
                FROM ' . $wpdb->prefix . 'terms
                WHERE
                    name LIKE "' . mysql_real_escape_string($cat) . '"
                    OR slug LIKE "' . mysql_real_escape_string($cat) . '"
        ';
        $cat_id = $wpdb->get_var($sql);

	if (isset($_GET['debug'])) {
		echo '<pre>';
		echo $sql;
		echo '<br />' . $cat_id;
		echo '</pre>';
	}

———————————–

What should I do about the ($cat) bit in brackets? should it be () after the esc_sql

I don’t know much about PHP, but I need to get this problem fixed very urgently, its on a very busy site which is losing a lot of its usual trade while the site’s un-editable.

Any chance of hearing from the plugin’s Developer on this thread?

@keved

mysql_real_excape_string() should be replaced with esc_sql() therefore the code will look like this:

—————————————

function sb_cl_get_cat_id_from_name($cat) {
global $wpdb;

$sql = ‘SELECT term_id
FROM ‘ . $wpdb->prefix . ‘terms
WHERE
name LIKE “‘ . esc_sql($cat) . ‘”
OR slug LIKE “‘ . esc_sql($cat) . ‘”
‘;
$cat_id = $wpdb->get_var($sql);

if (isset($_GET[‘debug’])) {
echo ‘

';
		echo $sql;
		echo '' . $cat_id;
		echo '

‘;
}

return $cat_id;
}

—————————————

Thanks.

The error messages have stopped.