Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes around it. How can I prevent the single quotes around the field name? The sql statement will not execute with the single quotes?

$query = $wpdb->prepare("SELECT DISTINCT wp_geo.%s, wp_geo.$field2 FROM wp_geo WHERE wp_geo.$field3=%s",$field1, $typevalue);

Output with single quotes around 'county_short' field name:

SELECT DISTINCT wp_geo.'county_short', wp_geo.county_slug FROM wp_geo WHERE wp_geo.type='trailers'

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

You cannot suppress the quotes in $wpdb. Run mysqli_real_escape_string() in your script on these variables.

share|improve this answer
add comment

You can't use prepare() on column names, only on values.

share|improve this answer
    
+1, the %s is intended as a placeholder for string variables only. If the column name is unknown (though rarely is) whitelist it. –  Stephen Harris Jan 8 '13 at 14:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.