Return to Answer

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $result = $wpdb->get_row( $wpdb->prepare(
         "
            SELECT * FROM `%s`
            WHERE `code` = `%s`
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    empty( $result ) AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_dump( $result, true ).'</pre>';
}

// some template.php
wpse73348_custom_table_query_test( true );

Edit by Otto:

Fixed prepare lines:

$blog_prefix = $wpdb->get_blog_prefix();
$result = $wpdb->get_row( $wpdb->prepare( 
    "SELECT * FROM {$blog_prefix}fxbase WHERE `code` = %s ", 
    $code ), 
 ARRAY_A );

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $wpdb->flush();
    $result = $wpdb->query( $wpdb->prepare(
         "
            SELECT * FROM %s
            WHERE `code` = %s
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    0 >= $wpdb->num_rows AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_export( $result, true )
         "\n Addt. Info: \n".var_export( $wpdb->last_result, true ).var_export( $wpdb->last_query, true ).var_export( $wpdb->col_info, true ).'</pre>';
}

// In some template.php
wpse73348_custom_table_query_test( true );

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $result = $wpdb->query( $wpdb->prepare(
         "
            SELECT * FROM `%s`
            WHERE `code` = `%s`
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    empty( $result ) AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_dump( $result, true )
         "\n Rows: \n".var_dump( $result->num_rows, true ).'</pre>';
}

// some template.php
wpse73348_custom_table_query_test( true );

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $result = $wpdb->get_row( $wpdb->prepare(
         "
            SELECT * FROM `%s`
            WHERE `code` = `%s`
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    empty( $result ) AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_dump( $result, true ).'</pre>';
}

// some template.php
wpse73348_custom_table_query_test( true );

Edit by Otto:

Fixed prepare lines:

$blog_prefix = $wpdb->get_blog_prefix();
$result = $wpdb->get_row( $wpdb->prepare( 
    "SELECT * FROM {$blog_prefix}fxbase WHERE `code` = %s ", 
    $code ), 
 ARRAY_A );

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $result = $wpdb->get_row( $wpdb->prepare(
         "
            SELECT * FROM `%s`
            WHERE `code` = `%s`
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    empty( $result ) AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_dump( $result, true ).'</pre>';
}

// some template.php
wpse73348_custom_table_query_test( true );

prepare() the right way

Things that don't need prepare: Default objects from $wpdb (make a dump to see what it got)

• Everything that's built into core: Table names, "Field", Row & Column names

Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.

Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).

You can only prepare two things:

• %s = strings
• %d = digits

Example

Try it like this:

// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
    global $wpdb;
    $result = $wpdb->query( $wpdb->prepare(
         "
            SELECT * FROM `%s`
            WHERE `code` = `%s`
         "
        ,$wpdb->get_blog_prefix().'fxbase '
        ,$code
    ), ARRAY_A );
    empty( $result ) AND $result = 'No result from query';

    if ( ! $dump )
        return $result;

    // Debug result
    echo '<pre>'.var_dump( $result, true )
         "\n Rows: \n".var_dump( $result->num_rows, true ).'</pre>';
}

// some template.php
wpse73348_custom_table_query_test( true );