3 ms·

Why on earth are people using string concatenation? Surely $wpdb->get_results should be deprecated in favour of something that accepts parameterised queries? W

• fabian2k 5y ago
  There is no excuse to concatenate the id into the query string, but the first parameter, the table prefix is not something you can do with parametrized queries. There are probably better ways to abstract this, but in the end if you need to dynamically determine the tables or columns you have to concatenate that stuff into your SQL query string.
• claudiulodro 5y ago
  You're supposed to build the string with $wpdb::prepare[1] before running it through get_results. This will prevent SQLi. It's been available and recommended for like a decade, and any WP code linter will yell at you if you're just building queries out of random concatenated strings. [1] https://developer.wordpress.org/reference/classes/wpdb/prepare/ https://developer.wordpress.org/reference/classes/wpdb/prepa...