Return to Answer

added 2 characters in body

Source Link

edited Aug 14, 2017 at 17:31

15.4k
11
43
79

You don’t need to use $wpdb->prepare()$wpdb->prepare() for ORDER BYORDER BY clauses. $wpdb->prepare()$wpdb->prepare() will always quote your variables.

Supposing you receive the ordering in the request, you can prevent SQL injection by not using the user entered value at all:

$sql = "SELECT....";
if ( 'asc' == $_GET['order'] ) {
    $sql .= ' ORDER BY p.post_date ASC';
} else {
    $sql .= ' ORDER BY p.post_date DESC';
}
$wpdb->prepare( $sql , $value_parameter );

You don’t need to use $wpdb->prepare() for ORDER BY clauses. $wpdb->prepare() will always quote your variables.

Supposing you receive the ordering in the request, you can prevent SQL injection by not using the user entered value at all:

$sql = "SELECT....";
if ( 'asc' == $_GET['order'] ) {
    $sql .= ' ORDER BY p.post_date ASC';
} else {
    $sql .= ' ORDER BY p.post_date DESC';
}
$wpdb->prepare( $sql , $value_parameter );

You don’t need to use $wpdb->prepare() for ORDER BY clauses. $wpdb->prepare() will always quote your variables.

Supposing you receive the ordering in the request, you can prevent SQL injection by not using the user entered value at all:

$sql = "SELECT....";
if ( 'asc' == $_GET['order'] ) {
    $sql .= ' ORDER BY p.post_date ASC';
} else {
    $sql .= ' ORDER BY p.post_date DESC';
}
$wpdb->prepare( $sql , $value_parameter );

Source Link

created Aug 14, 2017 at 17:18

Christian Lescuyer

You don’t need to use $wpdb->prepare() for ORDER BY clauses. $wpdb->prepare() will always quote your variables.

Supposing you receive the ordering in the request, you can prevent SQL injection by not using the user entered value at all:

$sql = "SELECT....";
if ( 'asc' == $_GET['order'] ) {
    $sql .= ' ORDER BY p.post_date ASC';
} else {
    $sql .= ' ORDER BY p.post_date DESC';
}
$wpdb->prepare( $sql , $value_parameter );