SQL injection prevention in Wordpress - Mini Project: Build & Apply

SQL Injection Prevention in WordPress

📖 Scenario: You are building a WordPress plugin that fetches user data from the database based on user input. To keep the site safe, you need to prevent SQL injection attacks by using WordPress's built-in database methods.

🎯 Goal: Create a safe WordPress function that retrieves user information by user ID, using prepared statements to prevent SQL injection.

📋 What You'll Learn

Create a variable holding a user ID number

Create a variable holding the global $wpdb object

Use $wpdb->prepare() to safely prepare the SQL query with the user ID

Use $wpdb->get_row() to fetch the user data using the prepared query

💡 Why This Matters

🌍 Real World

WordPress sites often need to query the database based on user input. Using prepared statements prevents attackers from injecting harmful SQL code.

💼 Career

Knowing how to prevent SQL injection is essential for WordPress developers to build secure plugins and themes.

1

Set up user ID variable

Create a variable called $user_id and set it to the integer value 5.

Wordpress

# Your code here
// Create $user_id variable with value 5

Need a hint?

Use $user_id = 5; to store the user ID.

2

Access the WordPress database object

Add a line to declare the global $wpdb variable to access the WordPress database object.

Wordpress

<?php
$user_id = 5;
// Declare global $wpdb variable
# Your code here

Need a hint?

Use global $wpdb; to access the database object.

3

Prepare the SQL query safely

Create a variable called $query that uses $wpdb->prepare() to prepare the SQL query string "SELECT * FROM wp_users WHERE ID = %d" with the $user_id variable.

Wordpress

<?php
$user_id = 5;
global $wpdb;
// Prepare the SQL query safely
# Your code here

Need a hint?

Use $wpdb->prepare() with the SQL string and $user_id as parameters.

4

Fetch the user data using the prepared query

Create a variable called $user_data that uses $wpdb->get_row() to execute the prepared $query and fetch the user data.

Wordpress

prepare("SELECT * FROM wp_users WHERE ID = %d", $user_id);
// Fetch user data using the prepared query
# Your code here

Need a hint?

Use $wpdb->get_row($query); to get the user data.