So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save.

But after this filter:

Thomas' OR SELECT * FROM wp_user

Is still save into DATABASE as full text. And ' char is not escaped as ' or \'.

I use $wpdb->query("INSERT INTO A (a,b,c) VALUES ('{$a}', '{$b}', '{$c}')"); So $a has to be a valid value here, which can be inserted into db. I have reasons not to use insert(), prepare() etc. specific functions, so I need to be sure that $a is VALID and SECURE. How to ensure that for text data like last name, or comment.

So is this brokes the security?

  • Are you saving these through raw SQL or update_*() functions? If it's the former then you'll need to also use prepare() - other than that, sanitize_text_field() is a normal sanitization function which is fine in most cases.
    – Howdy_McGee
    May 16, 2016 at 21:21
  • I don't wan't to use prepare(). I use $wpdb->query("INSERT INTO ... $x"); . I need a solution without prepare.
    – KestutisIT
    May 16, 2016 at 21:32
  • valid what? secure for what purpose?
    – Milo
    May 16, 2016 at 22:03
  • Updated the message. Valid text so that it could be inserted into db, and won't break db on insert process (i.e. will not drop other table or do something bad)
    – KestutisIT
    May 16, 2016 at 22:30
  • 2
    You want to be secure but you want to reinvent security oriented API. This doesn't make much sense. May 17, 2016 at 1:35

1 Answer 1


You can use wpdb insert function. It's better in every way.

It can care about data's escapeing itself and it's shorter.

You can use your own query anyway but I would recommended this article for reading https://codex.wordpress.org/Data_Validation#Database

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.