0

I've got this query:

$tenantsInfo = $wpdb->get_results("SELECT * FROM exp_ten WHERE tenant_number = " . (int) $user->ID);

I use some echo to show data on frontend:

if ($tenantsInfo) {
        foreach ($tenantsInfo as $tenant) { 
           echo "<h2>Welcome," . " " .$tenant->tenant_name. "</h2>";

When data, like tenant's name contains apostrophe, no data is displayed on frontend.

Could somebody please help me change mysql statement so apostrophe could be escaped? Or maybe there is different solution?

Thanks in advance!

2 Answers 2

1

Use esc_html() when outputting a string value inside tags. Use esc_attr() when you're outputting a string value inside an attribute="". If you're outputting a URL, use esc_url() instead of those two.

if ($tenantsInfo) {
        foreach ($tenantsInfo as $tenant) { 
           echo "<h2>Welcome, " . esc_html( $tenant->tenant_name ) . "</h2>";
        }
}
0

As this is not clear how you get the data inside the exp_ten table I would suggest use the esc_attr( $tenant->tenant_name ) which will encode the apostrophe along other things.

More info

3
  • Even better, use $wpdb->prepare().
    – janh
    Commented Nov 6, 2017 at 17:02
  • Unfortunately non of above works. Is it the correct use of $wpdb->prepare() ?: ` $tenantsInfo =` $wpdb->get_results( $wpdb->prepare( " SELECT * FROM exp_ten WHERE tenant_number = %s ", $user->ID ) );
    – webhappy
    Commented Nov 7, 2017 at 16:20
  • What do you mean by not working? What result is returned? Commented Nov 7, 2017 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.