this is my code:
$search_by_input= $_POST["search_by_input"];
$client_id_by_nick_name = $wpdb->get_results('SELECT user_id FROM '. $user_meta_table .' WHERE meta_value ='.$search_by_input, ARRAY_A);
it doesn't work. but when I write the value instead of variable it works:
$client_id_by_nick_name = $wpdb->get_results('SELECT user_id FROM '. $user_meta_table .' WHERE meta_value ="admin"', ARRAY_A);
when I use var_dump
for $search_by_input
it shows this:
string 'admin' (length=5)
The only difference between that two lines is double quotation(before and after admin
in second code.).
So Please tell me how can I fix this problem.
Thanks
$_POST["search_by_input"]
should be sanitized before being used in the query.