4

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes around it. How can I prevent the single quotes around the field name? The sql statement will not execute with the single quotes?

$query = $wpdb->prepare("SELECT DISTINCT wp_geo.%s, wp_geo.$field2 FROM wp_geo WHERE wp_geo.$field3=%s",$field1, $typevalue);

Output with single quotes around 'county_short' field name:

SELECT DISTINCT wp_geo.'county_short', wp_geo.county_slug FROM wp_geo WHERE wp_geo.type='trailers'

1
  • yes, for example, how can I avoid quotes on WHERE ID IN ('26975,27015,27016,27017,27018') ? $wpdb->prepare wraps my ids with quotes !
    – gordie
    Commented Dec 12, 2018 at 0:04

3 Answers 3

1

You cannot suppress the quotes in $wpdb. Run mysqli_real_escape_string() in your script on these variables.

7

You can use %1s which excludes single quotes wrapper. By using %1s, you will note that the string won't be having single quotes and you will get the values directly as needed.

$query = $wpdb->prepare("
              SELECT DISTINCT wp_geo.%1s, wp_geo.%1s
              FROM wp_geo
              WHERE wp_geo.%1s = %1s",
              $field1, 
              $field2, 
              $field3, 
              $typevalue
         );

Note: Here, the sequence should follow for %1s and the variable you are providing after the query.

4

You can't use prepare() on column names, only on values.

1
  • +1, the %s is intended as a placeholder for string variables only. If the column name is unknown (though rarely is) whitelist it. Commented Jan 8, 2013 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.