Tag Info

Hot answers tagged

2

From the Codex page for the WPDB class: [...] the prepare method [...] supports both a sprintf()-like and vsprintf()-like syntax. Having a look at PHP's documentation for sprintf(): Example 6 ... // notice the double %%, this prints a literal '%' character So you can use $result = $wpdb->get_var( $wpdb->prepare( ...


2

You want the query to look like this: SELECT email FROM wp_my_users WHERE email = 'mail@example.com' instead of this: SELECT email FROM 'wp_my_users' WHERE email = 'mail@example.com' So try to construct your query with: $sql = "SELECT email FROM {$my_table_name} WHERE email = %s"; $result = $wpdb->get_var( $wpdb->prepare( $sql, $email_address ...


1

Why not use get_comments(), instead of trying to roll your own with $wpdb? function display_sitewide_comments() { $sites = wp_get_sites(); $network_comments = array(); $max = 20; foreach( $sites as $site ) { switch_to_blog( $site->blog_id ); $args = array( 'number' => $max, 'status' => ...


1

I think it goes without saying that developers expect that a "prepared" statement means that it's "prepared" in the database! It was asked in a sub question if the statement can be used over and over. The wpdb->prepare does not actually "prepare" the statement. It only sanitizes the inputs. You can see this in: wordpress/wp-includes/wp-db.php. Look for the ...


1

You can't use prepare for column names, and you can't really use it for the sort order either. prepare will always quote the string. You will need to swap in the values yourself. Rather than try to "sanitize" the data, I'd use a white-list approach. $orderby = array( 'date' => 'post_date', // etc ); $sortorder = array( 'asc' => 'ASC', 'desc' ...


1

Read the wpdb docs and don't forget to protect your query: global $wpdb; $table_name = $wpdb->prefix . "item"; $login_name = sanitize_user( $_POST['login_name'] ); //assuming you're dealing with username $prepare = $wpdb->prepare( "SELECT * FROM $table_name WHERE uname = %s", $login_name ); $myrows = $wpdb->get_results( $prepare ); //output ...


1

What you did wrong here was to prepare those items in the first place. You only run "data" variables through prepare(). You don't run table names, or sort directions, or limits through it. These are part of the SQL command itself, they are not data that refers to information which is stored in a column in the database. Your SELECT query has no data ...


1

In a nutshell there is no generic reliable way to load WordPress core from arbitrary file. Since core and extensions directories are independent from each other (they are co-located by default, not by necessity) only core configuration "knows" where extensions are, but not other way around. In private code things like this just get hardcoded. In public code ...



Only top voted, non community-wiki answers of a minimum length are eligible