Plugin causing display of “Debugging in WordPress ” link on page

Found the same problem on a client website.

In easy-social-icons.php there are three wpdb::prepare() which have no % placeholder in query and trigger these notices.

We fixed it by using the SQL directly, which is fine in these cases as there is actually nothing to prepare.

line 124:

//$sql = $wpdb->prepare("SELECT id, title, url, image_url, sortorder, target FROM {$table_name} WHERE url != '' AND image_url != '' ORDER BY sortorder");

$sql = "SELECT id, title, url, image_url, sortorder, target FROM {$table_name} WHERE url != '' AND image_url != '' ORDER BY sortorder";

line 1177:

//$sql = $wpdb->prepare("SELECT * FROM {$table_name} WHERE image_url != '' AND url != '' ORDER BY sortorder");

$sql = "SELECT * FROM {$table_name} WHERE image_url != '' AND url != '' ORDER BY sortorder";

line 1255:

//$sql = $wpdb->prepare("SELECT * FROM {$table_name} WHERE image_url != '' AND url != '' $where_sql ORDER BY sortorder");

$sql = "SELECT * FROM {$table_name} WHERE image_url != '' AND url != '' $where_sql ORDER BY sortorder";

Note: Variable $where_sql in line 1255 is “prepared” before in line 1236.

There is also another small issue which we found and fixed. The “Title” is escaped wrong before insert/update.

lines 597 and 664:

//'title' => sanitize_title($_POST['title']),
'title' => sanitize_text_field($_POST['title']),

Easy Social Icons 3.2.4

Hello Ov3rfly,

Thank you for your very helpful response. I had identified the instances of wpdb::prepare() in the easy-social-icons.php, but did not have time to determine the fix required and had switched to another plugin. I applied the code you provided, all is now well and I have reinstated the plugin.

@cybernetikz I experienced the same problem, and it looks like you just have to use this provided code to solve this. Can you please release a version with a fix? Thank you!

Hello Ov3rfly,

Have you come accross the issue that I posted a couple of months ago?

Warning (Suppressed) mkdir(): Permission denied
wp-includes/functions.php:2057
mkdir()
wp-includes/functions.php:2057
wp_mkdir_p() wp-includes/functions.php:2368
wp_upload_dir()
wp-content/plugins/easy-social-icons/easy-social-icons.php:14

No.

That warning seems unrelated to the plugin and points to a more general problem within wp_upload_dir() caused by your uploads folder structure/permissions.

Hello Ov3rfly,
Thanks for your reply. I am only getting the error when this plugin is activated. I have checked all the permissions and couldn’t find anything that was causing the error.

hello,

this sql prepare issue is fixed in version 3.2.5

thanks to @ov3rfly