Is this plugin safe to run?

Question

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?

list($email_id, $user_id, $url, $anchor) = explode(';', base64_decode($_GET['r']), 4);
$wpdb->insert(NEWSLETTER_STATS_TABLE,
    array(
        'email_id' => $email_id,
        'user_id' => $user_id,
        'url' => $url,
        'anchor' => $anchor
    )
);

Answer 1

wpdb::_insert_replace_helper() will escape the data:

return $this->query( $this->prepare( $sql, $data ) );

But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.