Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [prepare-statement]

The tag has no usage guidance.

0
votes
1answer
521 views

$wpdb->prepare is not working like mysql_real_escape_string

I'm working on a WordPress plugin and recently I have planned to migrate from SQL to $wpdb. I'm using a method called $wpdb->prepare instead of mysql_real_escape_string but it does not work. Here ...
0
votes
1answer
52 views

How to prepare an array of values with $wpdb

I am looping through an array of products and want to create an OR string with the product skus. From my understanding, you pass a query and the variables to replace the placeholders in the SQL. So ...
4
votes
2answers
3k views

Use wpdb->prepare for `order by` column name

In my current plugin, I am picking up the order by column as user input. So I thought of using wpdb->prepare to escape it. $wpdb->get_results($wpdb->prepare("Select id from $wpdb->posts ...
1
vote
2answers
551 views

Quotes in table name

Since WP3.5, prepare() accepts placeholders as a security measure, instead of just appending the argument to the query. Therefore, $wpdb->prefix needs to become a second parameter, called by %s: $...
0
votes
3answers
2k views

What's wrong with my $wpdb prepare?

I can't get my head around this. I get this error: Parse error: syntax error, unexpected '"' in 224. The line is this between foreach $html: $html = ''; foreach ( $recent_across_network as $post )...
-1
votes
1answer
23 views

How much does $wpdb->prepare(), then $wpdb->query() VS straight $wpdb->query(), can slow down the load time of whole page

Let's assume that the $wpdb->query() is properly escaped as needed, so there is no must for use of $wpdb->prepare(). However, some new requirements at Envato, not the w.org, requires to go over ...
0
votes
2answers
116 views

$wpdb->prepare with LIKE and sprintf

Ok, I know similar questions have been asked before but none of the answers I found seem to work. Here's my code: $sql = $wpdb->prepare('SELECT ID FROM ' . $ignore_url_table_name . " where url ...
0
votes
0answers
41 views

bindParam? Wordpress 4.9.5 SQL LIKE statement %s and %LIKE%

My 1st post. :) Is there a function similar to bindParam in wpdb? Kind of like this (theoretical) setup?: $names = text, array, object...whatever $sql = "SELECT spouse FROM people_table WHERE ...
0
votes
1answer
145 views

Prepared statements used incorrectly in ACF?

I've just updated to WP 3.9 and it returns a warning when using placeholders incorrectly. I've found some prepared statements written incorrectly, but I really got worried when I saw this in the ACF-...
1
vote
2answers
538 views

Warning Notice $wpdb->prepare incorrect number of arguments passed

I am receiving this notice when trying to use the $wpdb->prepare function: Notice: wpdb::prepare was called incorrectly. The query does not contain the correct number of placeholders (7) for the ...
0
votes
1answer
1k views

SELECT query with prepare and placeholder for string

I am trying to learn how to do a simple Select query using $wpdb-prepare. I am checking wether an email submitted by the user is already available in the database. There has to be something wrong ...
0
votes
0answers
585 views

Rewrite SQL query as a prepared statement and use in foreach loop

I have a sql query that I use to populate a table with data. It looks like this <?php $client = $wpdb->get_results("SELECT concat (string, string2), type FROM `file` WHERE `code` = ...
1
vote
1answer
352 views

wpdb::prepare() isn't working

Here's my code: global $wpdb; $table_name = $wpdb->prefix . 'product_codes'; // Check if codes exist $query = $wpdb->prepare( "SELECT * FROM %s", $table_name ); $existing_data = $wpdb->...
0
votes
1answer
2k views

Inserting a MySQL record into a table with an array of field names and an array of values

I see this in the Codex: $wpdb->insert( $table, $data, $format ); I'm using this type of code and it works: $wpdb->query( $wpdb->prepare( "INSERT INTO `table` (`field1`,`...
0
votes
1answer
2k views

How to correctly pass values to wpdb->prepare()?

Look here: // $term_slugs is a function argument: array('foto', 'video') $term_query = "t.slug IN ('" . implode("','",$term_slugs) . "') "; $ids = $wpdb->get_results($wpdb->prepare(" SELECT ...
0
votes
1answer
447 views

How to pass orderby params to $wpdb->prepare()?

When passing values like 'ASC' or 'DESC' to prepare like: [...] $order = 'DESC'; [... (the whole query)], $order); // (as a prepare param) it doesn't work because the resulting query from something ...
0
votes
1answer
2k views

Missing argument 2 for wpdb::prepare() Issue

I'm having to update a WP installation for a community organisations from version 2.9.1 to the current 3.9.1. The installation has a couple of custom built plugins that aren't documented. I've just ...
0
votes
1answer
309 views

$wpdb->prepare returns empty array

For some reason the query in this function returns an empty array. I have been looking at this for far too long now and can't figure out why. Does anybody have an idea? Do i use $wpdb->prepare ...
1
vote
2answers
1k views

wpdb_prepare with multiple or condition

I want to execute a query like this: $wpdb->prepare( "SELECT * ... from ... WHERE ( post_title LIKE '%%%s%%' or post_content LIKE '%%%s%%' )..., $string ); If I do the query with only one ...
0
votes
1answer
67 views

prepare function sql safe method

I have a curious question about sql injection attack using $wpdb->prepare functions usages. https://codex.wordpress.org/Class_Reference/wpdb#Placeholders this link say prepare method is better to ...
0
votes
1answer
6k views

Fixing wpdb->get_results and wpdb->prepare?

So I have been using the theme Vilan from ThemeForest. Along with the theme come a couple of plugins, of which one is Revolution Slider. I'm also using Bedrock by Roots. I'm getting the following ...
2
votes
1answer
551 views

$wpdb->prepare not working with update table prefix

The following does not work with my custom table: $wpdb->prepare("UPDATE $wpdb->jch_gigs SET available = available - %d WHERE ID = %d", $quantity, $item) ); But this does: $wpdb->prepare(...
0
votes
1answer
576 views

How to use prepare to query with variables

Trying to write a prepare statement that works. This works: $countthem = $wpdb->get_var( "SELECT COUNT(*) FROM wp_cmapg WHERE lang = 'yes'" ); This does NOT work: $countthem = $wpdb->get_var(...
7
votes
2answers
3k views

What is the best way to sanitize data?

I've read several topics about this and different people have different views on the best practice. In terms of WordPress, how do I write data to the database the safest way? This is one insert I'm ...
0
votes
2answers
914 views

wpdb get_row database query inquiry

Is this the right way to use get_row with a select *? $_crds = $wpdb->get_row($wpdb->prepare(" SELECT * FROM `mailers` WHERE `id` = %d", $_GET['caId'] )); $_zipcodes = $_crds->zipcodes; $...
0
votes
2answers
2k views

Missing argument 2 for wpdb::prepare() [duplicate]

I am working on a website that uses a previously developed image slider plugin. I had it all working in my local environment but once I took it live it kicked the following error anywhere the image ...
0
votes
1answer
281 views

Proper Prepare Statement for ALTER TABLE and using AFTER

My code for ALTER TABLE doesn't make use of the prepare() method of $wpdb and so the code needs to be updated properly. There are plenty of examples of query SELECT, etc but couldn't find something ...
1
vote
1answer
82 views

How to prevent $wpdb->prepare stripping a leading zero in variable value?

I have a simple database_read function and per accident I noticed order_id's starting with a leading zero would not give me the expected results. It turns out using $wpdb->prepare strips out ...
1
vote
2answers
4k views

$wpdb-prepare : Do I have to bind a parameter to the table name?

I only do a SELECT on a whole table - and the table is defined in a variable: $table = $wpdb->prefix . 'members'; Do I have to bind a parameter to this variable? This caused an error: $result = ...
0
votes
1answer
315 views

Using “->” in a page to exceute $wpdb query gives error

I am doing some SQL queries in a WordPress page using the Insert PHP plugin, but the -> object operator changes to -&gt; when I write code in the Text editor, or view in the Visual editor. When ...
0
votes
1answer
687 views

Are term_taxonomy_id and term_id the same? [duplicate]

I have a custom query where I need a JOIN because I want to COUNT all the posts of a specific category. So I checked the tables and I found out that table wp_term_relationships contains a reference ...
0
votes
1answer
326 views

WPDB Table Does Not Exist

From this code: global $wpdb; $sidebar_table = $wpdb->prefix . 'w3care_sidebar_position'; $checkad = $wpdb->get_results( $wpdb->prepare( "SELECT ad_id, sidebar_position, ad_type FROM `%s` ...
0
votes
1answer
57 views

Retrieve a list of users based on some conditions

What am I doing wrong on this query? The main issue is the var_dump returns null. The query works fine in phpMyAdmin. global $wpdb; $users = $wpdb->get_results( $wpdb->prepare( "...
0
votes
3answers
736 views

selecting row using wpdb which contain special symbols

I got a table with one of the column have special charaters. I inserted to the table as $sql=$wpdb->prepare( "INSERT INTO `mytable` ( `question`, `remarks`) VALUES ('%...
0
votes
1answer
226 views

Incorrect Use of wpdb::prepare()

Not sure what I am doing wrong here. I did not write this code however I am receiving the following error in WordPress: The query argument of wpdb::prepare() must have a placeholder. This message ...
0
votes
2answers
1k views

WPDB Prepared Delete

I am attempting to delete a row from my DB.I am using inputs from the user and I need to be able to sanitize using the prepared statement. The query itself looks like - DELETE FROM ...
2
votes
1answer
1k views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
5
votes
2answers
6k views

Does $wpdb->prepare not create a prepared statement that I can execute multiple times?

I am wondering from the syntax $sql = $wpdb->prepare( 'query' [, value_parameter, value_parameter ... ] ) It appears (from the syntax - values within prepare) that it simple escapes values not ...
1
vote
2answers
57 views

How to use IN array properly in Wordpress?

I have an array containting these values (including the apostrohpes): 'course_3202','course_3201','course_3200','course_3199' I try to fetch results from these values in postmeta-table. SELECT * ...
2
votes
2answers
2k views

wpdb prepare: passing varible number of fields as second argument

As i want to manage the NULL fields in my db and wordpress functions doesn't allow to do so, i will need to dynamically generate a query depending on the situation. The problem is that i don't know ...
0
votes
1answer
2k views

mysql update user's password and activation key

Instead of using the Default WP reset password form, I'm creating my own and I'm stumped on this prepared statement. I'm trying to update the user's password by checking their user_login and ...
1
vote
1answer
2k views

wpdb prepare syntax

$arr = []; array_push( $arr, 'wp_table', 1, '2013-12-24', 3, 'NULL'); $sql_prepare = "INSERT INTO %s (id, datea, one, two) VALUES (%d, %s, %d, %s) ON DUPLICATE KEY UPDATE one = VALUES(one), two = ...
1
vote
1answer
177 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
0
votes
1answer
389 views

wpdb prepare sql problem

I have problem with wpdb prepare and sql query. If i run the query directly thru wpdb->get_results it's working fine. Here it is: $alabala_sql = $wpdb->prepare( " SELECT * FROM $wpdb-&...
4
votes
1answer
636 views

Custom query to get post names beginning with a digit

I'm implementing an A-Z index for a custom post type. I've got my links printing out the page and the query working for the letters. However, the numbers are tripping me up because I don't want them ...
4
votes
1answer
1k views

prepare() not working

When I do this: $transients = $wpdb->get_col( " SELECT option_name FROM $wpdb->options WHERE option_name LIKE '_transient_wb_tt_%' " ); It works ...
3
votes
2answers
4k views

wpdb->prepare function remove single quote for %s in SQL statment

I am using the below wpdb->prepare function in a sql statement. I am passing in several variables some field names and some values. When I try to use the %s for the field name it puts single quotes ...
2
votes
2answers
3k views

Can't pass table to $wpdb->prepare

I'm having trouble passing a table variable to $wpdb->prepare(); Here is functioning code: $table = $wpdb->get_blog_prefix( $blog_id ) . 'my_table'; $voters = $wpdb->get_row($wpdb->prepare("...