From f6617c1f07d170a4a9c73f9e14c81408ee66e8fb Mon Sep 17 00:00:00 2001
From: unknown <kate522@88.com>
Date: Wed, 15 Jul 2026 16:04:49 +0800
Subject: [PATCH] fix(db): correct $wpdb->prepare usage in forum board and API
 audit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Bind _aksrt_moderators with %s in get_user_managed_plates (stops 4× user-home notices)
- Guard API audit COUNT when no filter values (credits pattern)
---
 inc/classes/class-aksrt-api-audit.php                      | 7 ++++---
 .../trait-aksrt-forum-board-service-part-2.php             | 3 ++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/inc/classes/class-aksrt-api-audit.php b/inc/classes/class-aksrt-api-audit.php
index c9dc95d4..3d3080da 100644
--- a/inc/classes/class-aksrt-api-audit.php
+++ b/inc/classes/class-aksrt-api-audit.php
@@ -214,9 +214,10 @@ class AKSRT_API_Audit {
         $where_sql = implode(' AND ', $where);
         $offset = ($args['page'] - 1) * $args['per_page'];
 
-        $total = (int) $wpdb->get_var(
-            $wpdb->prepare("SELECT COUNT(*) FROM " . self::$table_name . " WHERE {$where_sql}", $values)
-        );
+        $count_sql = "SELECT COUNT(*) FROM " . self::$table_name . " WHERE {$where_sql}";
+        $total = (int) ($values
+            ? $wpdb->get_var($wpdb->prepare($count_sql, $values))
+            : $wpdb->get_var($count_sql));
 
         $values[] = $args['per_page'];
         $values[] = $offset;
diff --git a/inc/classes/forum/board-service-traits/trait-aksrt-forum-board-service-part-2.php b/inc/classes/forum/board-service-traits/trait-aksrt-forum-board-service-part-2.php
index 51b0852c..49251885 100644
--- a/inc/classes/forum/board-service-traits/trait-aksrt-forum-board-service-part-2.php
+++ b/inc/classes/forum/board-service-traits/trait-aksrt-forum-board-service-part-2.php
@@ -699,7 +699,8 @@ trait AKSRT_Forum_Board_Service_Part_2 {
         $mod_plate_ids = $wpdb->get_col($wpdb->prepare(
             "SELECT pm.post_id FROM {$wpdb->postmeta} pm
              INNER JOIN {$wpdb->posts} p ON p.ID = pm.post_id AND p.post_type = 'aksrt_forum_plate' AND p.post_status = 'publish'
-             WHERE pm.meta_key = '_aksrt_moderators'",
+             WHERE pm.meta_key = %s",
+            '_aksrt_moderators'
         ));
 
         foreach ($mod_plate_ids as $plate_id) {