Direct database queries (wpdb) in Wordpress

Introduction

Direct database queries let you get or change data in your WordPress site quickly. You use wpdb to talk to the database safely.

You want to get custom data not available through WordPress functions.

You need to update or delete specific database records directly.

You want to run a custom SQL query for reports or stats.

You need to insert new data into a custom table.

You want to optimize performance by writing your own query.

Syntax

Wordpress

$wpdb->get_results( 'SQL QUERY' );
$wpdb->get_var( 'SQL QUERY' );
$wpdb->query( 'SQL QUERY' );

Use get_results to get multiple rows as objects.

Use get_var to get a single value from the database.

Use query for insert, update, or delete operations.

Examples

Get all published posts as an array of objects.

Wordpress

$results = $wpdb->get_results( "SELECT * FROM wp_posts WHERE post_status = 'publish'" );

Get the total number of users as a single number.

Wordpress

$count = $wpdb->get_var( "SELECT COUNT(*) FROM wp_users" );

Change the site color option directly in the database.

Wordpress

$wpdb->query( "UPDATE wp_options SET option_value = 'blue' WHERE option_name = 'site_color'" );

Sample Program

This code gets the latest 3 published post titles from the WordPress database and prints them line by line.

Wordpress

<?php
// Access the global wpdb object
global $wpdb;

// Get the titles of the 3 most recent published posts
$recent_posts = $wpdb->get_results(
    "SELECT post_title FROM {$wpdb->prefix}posts WHERE post_status = 'publish' ORDER BY post_date DESC LIMIT 3"
);

// Print each post title
foreach ($recent_posts as $post) {
    echo $post->post_title . "\n";
}
?>

Important Notes

Always use $wpdb->prefix to get the correct table prefix for your site.

Use prepared statements with $wpdb->prepare() to avoid SQL injection risks.

Direct queries bypass WordPress caching, so use them carefully to avoid performance issues.

Summary

wpdb lets you run SQL queries directly on the WordPress database.

Use get_results, get_var, and query for different query types.

Always write safe queries using $wpdb->prepare() and the table prefix.

Practice

1. What is the main purpose of the $wpdb object in WordPress?

easy

A. To style WordPress themes with CSS

B. To create new WordPress posts automatically

C. To manage WordPress user sessions

D. To run direct SQL queries on the WordPress database safely

Solution

1. Step 1: Understand the role of $wpdb

   $wpdb is a WordPress class that allows running SQL queries directly on the database.

2. Step 2: Identify the correct purpose

   It is used to safely execute SQL queries, not for posts, sessions, or styling.

3. Final Answer:

   To run direct SQL queries on the WordPress database safely -> Option D

4. Quick Check:

   $wpdb = direct database queries [OK]

Hint: Remember: $wpdb is for database queries only [OK]

Common Mistakes:

• Confusing $wpdb with theme or user management
• Thinking $wpdb handles styling or sessions

2. Which of the following is the correct way to safely prepare a SQL query using $wpdb?

easy

A. $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id);

B. $wpdb->query("SELECT * FROM wp_posts WHERE ID = $id");

C. $wpdb->get_results("SELECT * FROM wp_posts WHERE ID = $id");

D. $wpdb->execute("SELECT * FROM wp_posts WHERE ID = %d", $id);

Solution

1. Step 1: Identify the safe query method

   $wpdb->prepare() safely inserts variables into SQL queries using placeholders like %d.

2. Step 2: Check each option

   $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id); uses prepare correctly with %d and variable $id. Others either lack preparation or use wrong methods.

3. Final Answer:

   $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id); -> Option A

4. Quick Check:

   Safe query uses prepare with placeholders [OK]

Hint: Use prepare with %d, %s for safe queries [OK]

Common Mistakes:

• Inserting variables directly without prepare
• Using wrong method names like execute
• Not using placeholders for variables

3. What will the following code return if the wp_users table has 3 users?

$count = $wpdb->get_var("SELECT COUNT(*) FROM wp_users");

medium

A. An array of user data

B. The number 3

C. A boolean true

D. An error message

Solution

1. Step 1: Understand get_var usage

   get_var returns a single value from the database, here the count of users.

2. Step 2: Interpret the SQL query

   The query counts rows in wp_users, which is 3 users.

3. Final Answer:

   The number 3 -> Option B

4. Quick Check:

   get_var returns single value count [OK]

Hint: get_var returns one value, not arrays [OK]

Common Mistakes:

• Expecting an array instead of a single value
• Confusing get_var with get_results
• Thinking it returns true/false

4. Identify the error in this code snippet:

$results = $wpdb->get_results("SELECT * FROM wp_posts WHERE post_status = 'publish'");
foreach($results as $post) {
  echo $post->post_title;
}

medium

A. Loop variable should be $results not $post

B. Incorrect method; should use query instead of get_results

C. No error; code works correctly

D. Missing $wpdb->prepare() for safe query

Solution

1. Step 1: Check query safety

   The query uses a fixed string 'publish' so no variable injection risk, so prepare is not required here.

2. Step 2: Analyze method and loop

   get_results returns an array of objects; looping with $post is correct. No syntax error here.

3. Final Answer:

   No error; code works correctly -> Option C

4. Quick Check:

   Fixed string query is safe without prepare [OK]

Hint: Use prepare when variables are in query [OK]

Common Mistakes:

• Ignoring query preparation for dynamic inputs
• Confusing get_results with query
• Misusing loop variables

5. You want to update the post title of a post with ID stored in $post_id safely using $wpdb. Which code snippet correctly does this?

hard

A. $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared);

B. $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared);

C. $wpdb->query("UPDATE wp_posts SET post_title = '$new_title' WHERE ID = $post_id");

D. $wpdb->update('wp_posts', ['post_title' => $new_title], ['ID' => $post_id]);

Solution

1. Step 1: Understand safe update with $wpdb

   Use prepare to safely insert variables, then run query with prepared SQL.

2. Step 2: Check each option

   $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); correctly prepares the query and then runs it. $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); calls prepare but does not assign or run the result properly. $wpdb->query("UPDATE wp_posts SET post_title = '$new_title' WHERE ID = $post_id"); is unsafe. $wpdb->update('wp_posts', ['post_title' => $new_title], ['ID' => $post_id]); uses update method but misses table prefix and is not asked here.

3. Final Answer:

   $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); -> Option A

4. Quick Check:

   Prepare query, assign, then query [OK]

Hint: Assign prepare result before running query [OK]

Common Mistakes:

• Running prepare without assigning result
• Inserting variables directly into SQL
• Confusing update method usage