Looking at $wpdb class, I found get_row, and I am unsure if the function automatically prepares the query. I believe it does not and I may have to reexamine my code to prevent a future disaster.

Here is what my code looks, and I feel that it is vulnerable:

$wpdb->get_row("SELECT * FROM `my_table` WHERE column = '".$_GET['fromUrl']."'", ARRAY_A);

However, I have tried injecting a malicious input with the follow: ' or column = 'value'

And it seems not to work, should I go ahead and prepare my statements anyway?


Yes, you should prepare the statement or at least SQL escape the value of $_GET['fromUrl']. It's good practice to be paranoid about any input potentially provided by the user as it will be wrong at some point.

The wpdb-reference says:

Briefly, though, all data in SQL queries must be SQL-escaped before the SQL query is executed to prevent against SQL injection attacks.

The prepared query would look something like this

       $wpdb->prepare("SELECT * FROM `my_table` WHERE column = %s",

which in my opinion is more readable, particularly the SQL query is easier to follow.

Furthermore, inspecting the user input may allow you provide the user better experience by creating meaningful notifications describing what has happened and how the user can cope with the inconvinience.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.