The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
13 views

Quotes in table name

Since WP3.5, prepare() accepts placeholders as a security measure, instead of just appending the argument to the query. Therefore, $wpdb->prefix needs to become a second parameter, called by %s: ...
0
votes
1answer
54 views

$wpdb->prepare is not working like mysql_real_escape_string

I'm working on a WordPress plugin and recently I have planned to migrate from SQL to $wpdb. I'm using a method called $wpdb->prepare instead of mysql_real_escape_string but it does not work. Here ...
0
votes
1answer
104 views

Fixing wpdb->get_results and wpdb->prepare?

So I have been using the theme Vilan from ThemeForest. Along with the theme come a couple of plugins, of which one is Revolution Slider. I'm also using Bedrock by Roots. I'm getting the following ...
0
votes
1answer
48 views

WPDB Table Does Not Exist

From this code: global $wpdb; $sidebar_table = $wpdb->prefix . 'w3care_sidebar_position'; $checkad = $wpdb->get_results( $wpdb->prepare( "SELECT ad_id, sidebar_position, ad_type FROM `%s` ...
0
votes
0answers
77 views

Sanitize a working query string by using $wpdb->prepare() fails with MySQL DB error “right syntax to use near '3' at line 1”

I was using the following properly working query so far: $querystr = " SELECT wposts.* FROM $wpdb->posts wposts, $wpdb->postmeta wpostmeta1, $wpdb->postmeta wpostmeta2 WHERE wposts.ID ...
0
votes
1answer
34 views

Retrieve a list of users based on some conditions

What am I doing wrong on this query? The main issue is the var_dump returns null. The query works fine in phpMyAdmin. global $wpdb; $users = $wpdb->get_results( $wpdb->prepare( ...
0
votes
3answers
66 views

selecting row using wpdb which contain special symbols

I got a table with one of the column have special charaters. I inserted to the table as $sql=$wpdb->prepare( "INSERT INTO `mytable` ( `question`, `remarks`) VALUES ...
0
votes
1answer
151 views

Inserting a MySQL record into a table with an array of field names and an array of values

I see this in the Codex: $wpdb->insert( $table, $data, $format ); I'm using this type of code and it works: $wpdb->query( $wpdb->prepare( "INSERT INTO `table` ...
0
votes
1answer
62 views

Incorrect Use of wpdb::prepare()

Not sure what I am doing wrong here. I did not write this code however I am receiving the following error in WordPress: The query argument of wpdb::prepare() must have a placeholder. This message ...
0
votes
2answers
212 views

WPDB Prepared Delete

I am attempting to delete a row from my DB.I am using inputs from the user and I need to be able to sanitize using the prepared statement. The query itself looks like - DELETE FROM ...
-1
votes
2answers
102 views

What's wrong with my $wpdb prepare

I can't get my head around this. I get this error: Parse error: syntax error, unexpected '"' in 224. The line is this between foreach $html: $html = ''; foreach ( $recent_across_network as $post ...
0
votes
1answer
92 views

Missing argument 2 for wpdb::prepare() Issue

I'm having to update a WP installation for a community organisations from version 2.9.1 to the current 3.9.1. The installation has a couple of custom built plugins that arent documented. Ive just ...
0
votes
1answer
103 views

Prepared statements used incorrectly in ACF?

I've just updated to WP 3.9 and it returns a warning when using placeholders incorrectly. I've found some prepared statements written incorrectly, but I really got worried when I saw this in the ...
2
votes
1answer
410 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
0
votes
1answer
561 views

Use wpdb->prepare for `order by` column name

In my current plugin, I am picking up the order by column as user input. So I thought of using wpdb->prepare to escape it. $wpdb->get_results($wpdb->prepare("Select id from $wpdb->posts ...
1
vote
2answers
51 views

How to use IN array properly in Wordpress?

I have an array containting these values (including the apostrohpes): 'course_3202','course_3201','course_3200','course_3199' I try to fetch results from these values in postmeta-table. SELECT * ...
0
votes
2answers
274 views

wpdb prepare: passing varible number of fields as second argument

As i want to manage the NULL fields in my db and wordpress functions doesn't allow to do so, i will need to dynamically generate a query depending on the situation. The problem is that i don't know ...
0
votes
1answer
197 views

Are term_taxonomy_id and term_id the same?

I have a custom query where I need a JOIN because I want to COUNT all the posts of a specific category. So I checked the tables and I found out that table wp_term_relationships contains a reference ...
0
votes
1answer
613 views

mysql update user's password and activation key

Instead of using the Default WP reset password form, I'm creating my own and I'm stumped on this prepared statement. I'm trying to update the user's password by checking their user_login and ...
1
vote
1answer
827 views

wpdb prepare syntax

$arr = []; array_push( $arr, 'wp_table', 1, '2013-12-24', 3, 'NULL'); $sql_prepare = "INSERT INTO %s (id, datea, one, two) VALUES (%d, %s, %d, %s) ON DUPLICATE KEY UPDATE one = VALUES(one), two = ...
0
votes
1answer
101 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
0
votes
1answer
124 views

wpdb_prepare with multiple or condition

I want to execute a query like this: $wpdb->prepare( "SELECT * ... from ... WHERE ( post_title LIKE '%%%s%%' or post_content LIKE '%%%s%%' )..., $string ); If I do the query with only one ...
0
votes
1answer
228 views

wpdb prepare sql problem

I have problem with wpdb prepare and sql query. If i run the query directly thru wpdb->get_results it's working fine. Here it is: $alabala_sql = $wpdb->prepare( " SELECT * FROM ...
4
votes
1answer
281 views

Custom query to get post names beginning with a digit

I'm implementing an A-Z index for a custom post type. I've got my links printing out the page and the query working for the letters. However, the numbers are tripping me up because I don't want them ...
4
votes
1answer
454 views

prepare() not working

When I do this: $transients = $wpdb->get_col( " SELECT option_name FROM $wpdb->options WHERE option_name LIKE '_transient_wb_tt_%' " ); It works ...
2
votes
2answers
1k views

wpdb->prepare function remove single quote for %s in SQL statment

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes ...
1
vote
2answers
1k views

Can't pass table to $wpdb->prepare

I'm having trouble passing a table variable to $wpdb->prepare(); Here is functioning code: $table = $wpdb->get_blog_prefix( $blog_id ) . 'my_table'; $voters = ...
4
votes
2answers
2k views

Does $wpdb->prepare not create a prepared statement that I can execute multiple times?

I am wondering from the syntax $sql = $wpdb->prepare( 'query' [, value_parameter, value_parameter ... ] ) It appears (from the syntax - values within prepare) that it simple escapes values not ...
6
votes
2answers
2k views

What is the best way to sanitize data?

I've read several topics about this and different ppl have different views on the best practice. In terms of WP, how do I store data to DB the safest way? This is one insert I'm using now: ...