3

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes around it. How can I prevent the single quotes around the field name? The sql statement will not execute with the single quotes?

$query = $wpdb->prepare("SELECT DISTINCT wp_geo.%s, wp_geo.$field2 FROM wp_geo WHERE wp_geo.$field3=%s",$field1, $typevalue);

Output with single quotes around 'county_short' field name:

SELECT DISTINCT wp_geo.'county_short', wp_geo.county_slug FROM wp_geo WHERE wp_geo.type='trailers'

  • yes, for example, how can I avoid quotes on WHERE ID IN ('26975,27015,27016,27017,27018') ? $wpdb->prepare wraps my ids with quotes ! – gordie Dec 12 '18 at 0:04
0

You cannot suppress the quotes in $wpdb. Run mysqli_real_escape_string() in your script on these variables.

1

You can't use prepare() on column names, only on values.

  • +1, the %s is intended as a placeholder for string variables only. If the column name is unknown (though rarely is) whitelist it. – Stephen Harris Jan 8 '13 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.