The Basics of `$wpdb->prepare()` — Why You Should Never Build SQL Queries With String Concatenation

When a WordPress plugin or theme needs to talk to the database directly, it uses the core-provided global object $wpdb. The one thing to absolutely avoid when doing so is dropping user input straight into a SQL string through concatenation. The tool WordPress provides instead is $wpdb->prepare(). This post looks at why that matters and what the... Weiterlesen: The Basics of `$wpdb->prepare()` — Why You Should Never Build SQL Que…