Wordpress actually provides a database wrapper (I wouldn't call it an ORM) called WPDB, which can use prepared statements. In practice though, I have found mys

Wordpress actually provides a database wrapper (I wouldn't call it an ORM) called WPDB, which can use prepared statements. In practice though, I have found myself on more than one occasion just using PDO in my plugins. WPDB is slower, and its API is weird, like a lot of APIs in Wordpress land are.