WP 3.5 : Missing argument 2 for wpdb::prepare

  • Hi,

    I got the following error message in the “settings” tab of STT2 since wordpress 3.5 upgrade :

    Warning: Missing argument 2 for wpdb::prepare(), called in /home/(…)wp-content/plugins/searchterms-tagging-2/searchterms-tagging2.php on line 658 and defined in /home/(…)/wp-includes/wp-db.php on line 990

    There is another similar error about line 695 in the same file. I guess you (STT2 users) all see this error since wp 3.5.

    Googling the error message led me to this page : apparently nothing is broken, but there might be a risk of SQL injection with STT2 plugin. Since it seems that the developer is not around anymore, can someone more savvy give some advice about it ?

    I noticed that replacing on line 658 :

    $post_count = $wpdb->get_var($wpdb->prepare( $sql ));

    by a direct query

    $post_count = $wpdb->query( $sql );

    … removes the first warning, and that adding a dummy argument in the query on line 695 removes the other one while keeping everything functional …

    $post_count = $wpdb->get_var($wpdb->prepare( $sql, $id));

    … but this is pure speculation as I do not understand exactly why WordPress now throws this error message in the first place ??

    Any comment would be appreciated!
    Thank you,

    Cyril

    https://www.ads-software.com/extend/plugins/searchterms-tagging-2/

Viewing 8 replies - 1 through 8 (of 8 total)

  • I am also facing the same error in the promote post section of my website https://admissions.aglasem.com.

    Warning: Missing argument 2 for wpdb::prepare(), called in /home/aglaadm/public_html/wp-content/plugins/searchterms-tagging-2/searchterms-tagging2.php on line 658 and defined in /home/aglaadm/public_html/wp-includes/wp-db.php on line 990

Warning: Missing argument 2 for wpdb::prepare(), called in /home/aglaadm/public_html/wp-content/plugins/searchterms-tagging-2/searchterms-tagging2.php on line 695 and defined in /home/aglaadm/public_html/wp-includes/wp-db.php on line 990

    Is the plugin safe enough to use now as there is no update for the plugin.

    I am not a WordPress expert by far, but it appears to me that WP3.5 adds functionality that this plugin does not need or use. But it throws an error because the plugin just isn’t programmed to be aware of the new capabilities.

    lecyril is on the right track. But I do not recommend changing any functions such as ‘get_var’ to ‘query’. Doing so could make the plugin unsafe.

    The better solution is to use lecyril’s dummy argument idea. Anywhere you find “$wpdb->prepare( $sql )” (with $sql being a variable as shown or any string contained in quotes), just add in an empty string (contained in either single- or double-quotes) as a dummy argument, ie:
    $wpdb->prepare( $sql, ” ) , or
    $wpdb->prepare( $sql, “” )

    In this case, both are functionally equivalent.

    Thread Starter lecyril

    (@lecyril)

    Thank you very much terry.g for your answer.
    I will fix this on my websites by editing wp-content/plugins/searchterms-tagging-2/searchterms-tagging2.php the way you suggest, and keep hoping that the author of this great plugin will come back some day for an “official” update!

    Im getting the same errors, it seems this plugins don’t support the very recent update of wordpress.

    Im gonna try the solution mentioned by terry.g

    Edit: just noticed that author at his blog says

    So starting today, I highly recommend and urge all my friends to no longer use auto-tagging and a link to the search page SEO plugin searchterms Tagging 2.

    link: https://exclusivewp.com/2011/google-panda-dan-seo-searchterms-tagging-2.html

    Guys I’ve found a fix on a Turkish SEO site:

    Go to your SEO SearchTerms Tagging 2 Editor >searchterms-tagging-2/searchterms-tagging2.php and Change Fallowing code:

    $post_count = $wpdb->get_var($wpdb->prepare( $sql ));
    to
    $post_count = $wpdb->get_var($wpdb->prepare( $sql, “”));

    If it’s not enough and you are still seeing the Warning message change also:
    $post_title = $wpdb->get_var($wpdb->prepare( $sql ));
    to
    $post_title = $wpdb->get_var($wpdb->prepare( $sql, “”));

    Have a nice day!
    Source:
    (Second pice of code are not included in this article,but I’ve still had 1 warning, so found the code and change the way what I did in first one )

    great thanks, I am going to try it.

    I too got the error! See that:

    https://www.ads-software.com/support/topic/warning-missing-argument-2-for-wpdbprepare-19?replies=1

    Spot on daninho! Fixed it for me ??

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘WP 3.5 : Missing argument 2 for wpdb::prepare’ is closed to new replies.