2


this is my code:

$search_by_input= $_POST["search_by_input"];
$client_id_by_nick_name = $wpdb->get_results('SELECT user_id FROM '. $user_meta_table .' WHERE meta_value ='.$search_by_input, ARRAY_A);

it doesn't work. but when I write the value instead of variable it works:

$client_id_by_nick_name = $wpdb->get_results('SELECT user_id FROM '. $user_meta_table .' WHERE meta_value ="admin"', ARRAY_A);

when I use var_dump for $search_by_input it shows this:

string 'admin' (length=5)

The only difference between that two lines is double quotation(before and after admin in second code.).
So Please tell me how can I fix this problem.
Thanks

3
  • Just an aside, but $_POST["search_by_input"] should be sanitized before being used in the query. Mar 31, 2017 at 21:06
  • Is it harmful for security if I don't sanitized it?
    – Sadegh
    Apr 1, 2017 at 9:04
  • Yes, user input should never be trusted. Apr 1, 2017 at 14:15

1 Answer 1

2

Try it:

$search_by_input= $_POST["search_by_input"];
$client_id_by_nick_name = $wpdb->get_results( sprintf( "SELECT user_id FROM `%s` WHERE meta_value = '%s';", $user_meta_table, $search_by_input ), ARRAY_A);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.