Input validation on wp-includes/SimplePie/Cache/MySQL.php in line 344

[OswaldoMG]

SQL Injection

This database query contains a SQL injection flaw. The function call constructs a dynamic SQL query using a variable derived from user-supplied input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database.

Found by static analysis application.

344   $query = $this->mysql->prepare($sql);

Recommendations: Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

[nacin]

If you're going to submit any more static code analysis tickets, please read the ticket form first:

Do not report potential security vulnerabilities here.
See the ​Security FAQ and contact security@….

---

This is invalid. The query is properly prepared. We also don't use SimplePie's MySQL cache in WordPress anyway.