WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes around it. How can I prevent the single quotes around the field name? The sql statement will not execute with the single quotes?

$query = $wpdb->prepare("SELECT DISTINCT wp_geo.%s, wp_geo.$field2 FROM wp_geo WHERE wp_geo.$field3=%s",$field1, $typevalue);

Output with single quotes around 'county_short' field name:

SELECT DISTINCT wp_geo.'county_short', wp_geo.county_slug FROM wp_geo WHERE wp_geo.type='trailers'

share|improve this question
up vote 0 down vote accepted

You cannot suppress the quotes in $wpdb. Run mysqli_real_escape_string() in your script on these variables.

share|improve this answer

You can't use prepare() on column names, only on values.

share|improve this answer
+1, the %s is intended as a placeholder for string variables only. If the column name is unknown (though rarely is) whitelist it. – Stephen Harris Jan 8 '13 at 14:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.