3 ms·
>Also $wpdb->prepare() uses parametrised values. They appear to be a hand-rolled PHP version of imitation client-side parameterized values, not the actual data
by tyingq 4y ago
>Also $wpdb->prepare() uses parametrised values.
They appear to be a hand-rolled PHP version of imitation client-side parameterized values, not the actual database library ones.
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wpdb.php#L1494 https://github.com/WordPress/WordPress/blob/master/wp-includ...
- berkle4455 4y agoWow. That is so much code just to avoid calling mysqli_prepare(). And they insist on using a weird printf inspired syntax instead of ? or :field.
- tyingq 4y agoI suppose it's pretty battle-hardened by now, but I'd be afraid to ever touch that code for fear of introducing a SQL injection.