I have a curious question about sql injection attack using $wpdb->prepare functions usages. https://codex.wordpress.org/Class_Reference/wpdb#Placeholders this link say prepare method is better to protect sql injection. So I use below code with prepare.

    $query = $new_wpdb->prepare(
    "INSERT INTO sym_data
    ( user_id, country, dob, height, weight, bmi )
    VALUES ( %d, %s, %s, %d, %d, %f)",
    $user_id, $country, $dob, $height, $weight, $bmi


Check below code

        'user_id' => $user_id,
        'country' => $country,
        'dob' => $dob,
        'height' => $height,
        'weight' => $weight,
        'bmi' => $bmi,


I would like to know what differences is between these code blocks. Results are the same.

First code block is with prepare method

Second one is with placeholder

1 Answer 1


Both methods are okay ($new_wpdb->insert actually uses $new_wpdb->prepare) and provide the same level of safety when it comes to SQL escaping.

$new_wpdb->insert is the preferred method unless you're writing your own custom SQL query.

  • @por sure! Please accept my answer if you're satisfied with my response. :-)
    – cowgill
    Commented Sep 17, 2016 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.