Let's assume that the $wpdb->query()
is properly escaped as needed, so there is no must for use of $wpdb->prepare()
. However, some new requirements at Envato, not the w.org, requires to go over prepare function first, that , in my opinion, has 4 cons:
Hard to read the query text, if we have more than 10 variables out there.
Slows down the website load, if we say we have 500 queries on the plugin.
Is not well suitable for dynamic query params, i.e. for geo-location search that may have, or may not have country, city, state, zip code, street address, apt. number. We cannot use prepare for each of scenarios, as it will get too big in the code-wise.
- There is no need for double-validation. Especially if the given validation is already validated via [A-Z-_0-9] regexp, while the '%s' validation is more global and can allow to save to DB something that we don't to allow.
So how much does $wpdb->prepare()
, then $wpdb->query()
VS straight $wpdb->query()
, can slow down the load time of whole page, and should I need to take care of that.