Tag Info

Hot answers tagged

3

The insert method of $wpdb already scapes the data taking care of SQL injection. What you should worry about is about data sanitization and validation. For exmpla: Sanitization What type of data do you accept in $votes? A integer value? If so, be sure $votes contains a integer value. You cuold do it, for exmaple, using intval function from PHP. This is ...


2

No! WordPress will not protect against SQL injection in this case. You need to do so yourself, using $wpdb->esc_like and $wpdb->prepare: if ( isset( $_GET['q'] ) ) { // WordPress forces magic quotes (god knows why), unslash it $value = wp_unslash( ( string ) $_GET['q'] ); // Escape like wildcards so that MySQL interprets them as ...


2

wpdb::insert already protects against SQL injection, it's a wrapper for wpdb::prepare For insert(), you can pass a third "formats" argument for extra sanitization: $wpdb->insert( 'votes', array( 'votes' => $votes, 'competition' => $competition, 'uid' => $uid ), array( '%s', // $votes will ...


1

Like your sample: $results = array( (object)array('id'=>1, ...



Only top voted, non community-wiki answers of a minimum length are eligible