New answers tagged sanitization
0
If You are not allowing users to register site, you may disable 'uppercase' restriction from MS install, just add into your theme functions.php file:
remove_action( 'sanitize_user', 'strtolower' );
6
I can't use $wpdb->prepare, since I want to be able to add variables
to my query string that look something like:
$var = "AND pm.meta_value = '%$_POST['val']%'";
To get a literal % to pass through $wpdb->prepare just double it. You don't need to be avoiding $wpdb->prepare.
Proof of concept:
var_dump($wpdb->prepare('SELECT * FROM ...
4
Use mysqli_real_escape_string().
The core uses still the deprecated mysql_real_escape_string() or add_slashes() in wpdb::_real_escape() …
/**
* Real escape, using mysql_real_escape_string() or addslashes()
*
* @see mysql_real_escape_string()
* @see addslashes()
* @since 2.8.0
* @access private
*
* @param string $string to escape
* @return ...
Top 50 recent answers are included
