Direct database queries (wpdb) in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to get all rows from a custom table using $wpdb.

Wordpress

$results = $wpdb->[1]("SELECT * FROM wp_custom_table");

Drag options to blanks, or click blank then click option'

Aupdate

Bquery

Cinsert

Dget_results

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'query' instead of 'get_results' returns number of rows, not data.

Using 'insert' or 'update' methods for SELECT queries.

The get_results method fetches multiple rows from the database as an array of objects.

2fill in blank

medium

Complete the code to safely prepare a query with a variable using $wpdb->prepare.

Wordpress

$sql = $wpdb->prepare("SELECT * FROM wp_users WHERE ID = [1]", $user_id);

Drag options to blanks, or click blank then click option'

A%d

B%s

C%f

D%u

Attempts:

3 left

💡 Hint

Common Mistakes

Using %s for numbers can cause SQL errors or injection risks.

Using %f for integers is incorrect.

The %d placeholder is used for integers in $wpdb->prepare.

3fill in blank

hard

Fix the error in the code to insert a new row safely using $wpdb.

Wordpress

$wpdb->[1]('wp_custom_table', array('name' => $name, 'age' => $age), array([2], [3]));

Drag options to blanks, or click blank then click option'

Ainsert

Bupdate

C%s

D%d

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'update' instead of 'insert' for adding new rows.

Wrong format placeholders cause data type errors.

Use insert to add a row. The format array needs %s for string and %d for integer.

4fill in blank

hard

Fill both blanks to update a user's email safely using $wpdb.

Wordpress

$wpdb->[1]('wp_users', array('user_email' => $email), array('ID' => $user_id), array([2]), array([3]));

Drag options to blanks, or click blank then click option'

Aupdate

Binsert

C%s

D%d

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'insert' instead of 'update' to modify data.

Mixing up the order of format placeholders.

Use update to change data. The format array matches the data types: string for email, integer for ID.

5fill in blank

hard

Fill all three blanks to delete a user by ID safely using $wpdb.

Wordpress

$wpdb->[1]('wp_users', array('ID' => [2]), array([3]));

Drag options to blanks, or click blank then click option'

Adelete

B$user_id

C%d

Dupdate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'update' instead of 'delete' to remove data.

Not using the variable for the ID in the where clause.

Use delete to remove rows. The where clause uses the user ID variable, and the format is integer %d.

Practice

1. What is the main purpose of the $wpdb object in WordPress?

easy

A. To style WordPress themes with CSS

B. To create new WordPress posts automatically

C. To manage WordPress user sessions

D. To run direct SQL queries on the WordPress database safely

Solution

1. Step 1: Understand the role of $wpdb

   $wpdb is a WordPress class that allows running SQL queries directly on the database.

2. Step 2: Identify the correct purpose

   It is used to safely execute SQL queries, not for posts, sessions, or styling.

3. Final Answer:

   To run direct SQL queries on the WordPress database safely -> Option D

4. Quick Check:

   $wpdb = direct database queries [OK]

Hint: Remember: $wpdb is for database queries only [OK]

Common Mistakes:

• Confusing $wpdb with theme or user management
• Thinking $wpdb handles styling or sessions

2. Which of the following is the correct way to safely prepare a SQL query using $wpdb?

easy

A. $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id);

B. $wpdb->query("SELECT * FROM wp_posts WHERE ID = $id");

C. $wpdb->get_results("SELECT * FROM wp_posts WHERE ID = $id");

D. $wpdb->execute("SELECT * FROM wp_posts WHERE ID = %d", $id);

Solution

1. Step 1: Identify the safe query method

   $wpdb->prepare() safely inserts variables into SQL queries using placeholders like %d.

2. Step 2: Check each option

   $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id); uses prepare correctly with %d and variable $id. Others either lack preparation or use wrong methods.

3. Final Answer:

   $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id); -> Option A

4. Quick Check:

   Safe query uses prepare with placeholders [OK]

Hint: Use prepare with %d, %s for safe queries [OK]

Common Mistakes:

• Inserting variables directly without prepare
• Using wrong method names like execute
• Not using placeholders for variables

3. What will the following code return if the wp_users table has 3 users?

$count = $wpdb->get_var("SELECT COUNT(*) FROM wp_users");

medium

A. An array of user data

B. The number 3

C. A boolean true

D. An error message

Solution

1. Step 1: Understand get_var usage

   get_var returns a single value from the database, here the count of users.

2. Step 2: Interpret the SQL query

   The query counts rows in wp_users, which is 3 users.

3. Final Answer:

   The number 3 -> Option B

4. Quick Check:

   get_var returns single value count [OK]

Hint: get_var returns one value, not arrays [OK]

Common Mistakes:

• Expecting an array instead of a single value
• Confusing get_var with get_results
• Thinking it returns true/false

4. Identify the error in this code snippet:

$results = $wpdb->get_results("SELECT * FROM wp_posts WHERE post_status = 'publish'");
foreach($results as $post) {
  echo $post->post_title;
}

medium

A. Loop variable should be $results not $post

B. Incorrect method; should use query instead of get_results

C. No error; code works correctly

D. Missing $wpdb->prepare() for safe query

Solution

1. Step 1: Check query safety

   The query uses a fixed string 'publish' so no variable injection risk, so prepare is not required here.

2. Step 2: Analyze method and loop

   get_results returns an array of objects; looping with $post is correct. No syntax error here.

3. Final Answer:

   No error; code works correctly -> Option C

4. Quick Check:

   Fixed string query is safe without prepare [OK]

Hint: Use prepare when variables are in query [OK]

Common Mistakes:

• Ignoring query preparation for dynamic inputs
• Confusing get_results with query
• Misusing loop variables

5. You want to update the post title of a post with ID stored in $post_id safely using $wpdb. Which code snippet correctly does this?

hard

A. $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared);

B. $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared);

C. $wpdb->query("UPDATE wp_posts SET post_title = '$new_title' WHERE ID = $post_id");

D. $wpdb->update('wp_posts', ['post_title' => $new_title], ['ID' => $post_id]);

Solution

1. Step 1: Understand safe update with $wpdb

   Use prepare to safely insert variables, then run query with prepared SQL.

2. Step 2: Check each option

   $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); correctly prepares the query and then runs it. $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); calls prepare but does not assign or run the result properly. $wpdb->query("UPDATE wp_posts SET post_title = '$new_title' WHERE ID = $post_id"); is unsafe. $wpdb->update('wp_posts', ['post_title' => $new_title], ['ID' => $post_id]); uses update method but misses table prefix and is not asked here.

3. Final Answer:

   $prepared = $wpdb->prepare("UPDATE wp_posts SET post_title = %s WHERE ID = %d", $new_title, $post_id); $wpdb->query($prepared); -> Option A

4. Quick Check:

   Prepare query, assign, then query [OK]

Hint: Assign prepare result before running query [OK]

Common Mistakes:

• Running prepare without assigning result
• Inserting variables directly into SQL
• Confusing update method usage