prepare()
the right way
Things that don't need prepare: Default objects from $wpdb
(make a dump to see what it got)
- Everything that's built into core: Table names, "Field", Row & Column names
Everything else must get prepared. And this isn't only user input, but also everything else like custom table, "field", row & column names.
Rule of thumb: Prepare as late as possible and let come nothing between the preparation and the query (if possible).
You can only prepare two things:
Example
Try it like this:
// functions.php
function wpse73348_custom_table_query_test( $dump = false )
{
global $wpdb;
$wpdb->flush();
$result = $wpdb->query( $wpdb->prepare(
"
SELECT * FROM %s
WHERE `code` = %s
"
,$wpdb->get_blog_prefix().'fxbase '
,$code
), ARRAY_A );
0 >= $wpdb->num_rows AND $result = 'No result from query';
if ( ! $dump )
return $result;
// Debug result
echo '<pre>'.var_export( $result, true )
"\n Addt. Info: \n".var_export( $wpdb->last_result, true ).var_export( $wpdb->last_query, true ).var_export( $wpdb->col_info, true ).'</pre>';
}
// In some template.php
wpse73348_custom_table_query_test( true );