I've read several topics about this and different people have different views on the best practice.

In terms of WordPress, how do I write data to the database the safest way?

This is one insert I'm using now:

$result = $wpdb->insert(
    $table_name , 
        'arena'         => $galleryData['arena'],
        'year'          => substr( $galleryData['season'], 2 ),
        'copyright'     => $galleryData['copyright'],
        'description'   => $galleryData['description'],
        'path'          => $galleryData['path'],
        'fk_brand_id'   => $galleryData['brand']
    array( '%s', '%d', '%s', '%s', '%s', '%d' )

Another way of inserting data is doing this:

$sanitized_sql = $wpdb->prepare( "
    INSERT INTO my_plugin_table 
        field1 = %1$d,
        field2 = %2$s,
        field3 = %3$s’,
        'Aaron Brazell',
        'Washington, D.C'
" );
$wpdb->query( $sanitized_sql );

Do I still need to sanitize data using wp_kses() or mysql_real_escape_string()?

I'm just confused on what method is the better for safely writing data to the database. I found a helpful answer on Stack Overflow.

So should I or should I not sanitize data before input?

2 Answers 2


No the sanitization is already done. Well the mysql_real_escape_string is done, it's considered bad form to filter html on input. I personally think doing it on output kinda breaches DRY. If you did in WordPress I highly suspect somewhere else will do it again resulting in double html entities encoding.

Also by the way, wpdb::insert is basically just a wrapper for wpdb::prepare.

  • Thanks for clearing that up. So there is no real point in using wp_kses before storing data to DB? Or any other filter found here? codex.wordpress.org/Data_Validation
    – Steven
    Jan 29, 2011 at 11:57
  • Well I guess it really depends what you're doing with the data. If you're handling it yourself completely then good form is to do it on output.
    – Backie
    Jan 29, 2011 at 12:22

Note that storing data safely is different from safe data. For example JavaScript code can be totally harmless in context of database security, but nightmare in context of front-end.

There is no single blanket approach, that is why WordPress has massive amount of related functions.

You must consider:

  1. What data is.
  2. Where it comes from.
  3. How is it going to be used.
  • Do you have any good references for point 1-3? I've seen the Data Validation page - that's what I've been using so far. But I'm still unsure of what is better practice for storing / retrieving data the safest way inputed by users.
    – Steven
    Jan 30, 2011 at 11:27
  • @Steven well, that page is quite comprehensive in context of WP. Most important point is at start - " untrusted data [..] needs to be validated both on input and output ". So you need to sanitize untrusted data when it goes to database (->prepare() and such) and when it goes to display (esc_ and such).
    – Rarst
    Jan 30, 2011 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.