I have a curious question about sql injection attack using $wpdb->prepare functions usages. https://codex.wordpress.org/Class_Reference/wpdb#Placeholders this link say prepare method is better to protect sql injection. So I use below code with prepare.

    $query = $new_wpdb->prepare(
    "INSERT INTO sym_data
    ( user_id, country, dob, height, weight, bmi )
    VALUES ( %d, %s, %s, %d, %d, %f)",
    $user_id, $country, $dob, $height, $weight, $bmi


Check below code

        'user_id' => $user_id,
        'country' => $country,
        'dob' => $dob,
        'height' => $height,
        'weight' => $weight,
        'bmi' => $bmi,


I would like to know what differences is between these code blocks. Results are the same.

First code block is with prepare method

Second one is with placeholder


Both methods are okay ($new_wpdb->insert actually uses $new_wpdb->prepare) and provide the same level of safety when it comes to SQL escaping.

$new_wpdb->insert is the preferred method unless you're writing your own custom SQL query.

  • @por sure! Please accept my answer if you're satisfied with my response. :-) – cowgill Sep 17 '16 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.