I have a curious question about sql injection attack using $wpdb->prepare functions usages. https://codex.wordpress.org/Class_Reference/wpdb#Placeholders this link say prepare method is better to protect sql injection. So I use below code with prepare.
$query = $new_wpdb->prepare( "INSERT INTO sym_data ( user_id, country, dob, height, weight, bmi ) VALUES ( %d, %s, %s, %d, %d, %f)", $user_id, $country, $dob, $height, $weight, $bmi ); $new_wpdb->query($query);
Check below code
$new_wpdb->insert( 'sym_data', array( 'user_id' => $user_id, 'country' => $country, 'dob' => $dob, 'height' => $height, 'weight' => $weight, 'bmi' => $bmi, ), array( '%d', '%s', '%s', '%d', '%d', '%0.6f' ) );
I would like to know what differences is between these code blocks. Results are the same.
First code block is with prepare method
Second one is with placeholder