SQL injection prevention in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SQL injection?

SQL injection is a security attack where harmful SQL code is inserted into a query to manipulate or access the database in unauthorized ways.

beginner

How does WordPress help prevent SQL injection?

WordPress uses prepared statements and the $wpdb class to safely handle database queries, which helps prevent SQL injection by separating code from data.

intermediate

What is a prepared statement in WordPress?

A prepared statement is a way to write SQL queries where placeholders are used for data. WordPress replaces these placeholders safely to avoid SQL injection.

beginner

Why should you never directly insert user input into SQL queries?

Directly inserting user input can allow attackers to add harmful SQL code, leading to data leaks or damage. Always sanitize or use prepared statements.

beginner

Which WordPress function helps safely prepare SQL queries?

The $wpdb->prepare() function helps safely prepare SQL queries by escaping user input and using placeholders.

Which WordPress class is commonly used to interact with the database safely?

A $db_query

B $wpdb_safe

C $sql_inject

D $wpdb

The $wpdb class is the standard WordPress database access class that supports safe queries.

What does $wpdb->prepare() do?

A Prepares SQL queries safely with placeholders

B Executes SQL queries directly

C Deletes unsafe data from the database

D Encrypts the database

$wpdb->prepare() safely prepares SQL queries by using placeholders to avoid injection.

Why is it unsafe to insert user input directly into SQL queries?

A It slows down the query

B It uses more memory

C It can cause SQL injection attacks

D It makes the code longer

Direct insertion of user input can allow attackers to inject harmful SQL code.

Which of these is a good practice to prevent SQL injection in WordPress?

A Use raw SQL queries with string concatenation

B Use prepared statements with $wpdb->prepare()

C Disable the database

D Ignore user input validation

Using prepared statements is the recommended way to prevent SQL injection.

What is a placeholder in a prepared statement?

A A symbol in SQL query replaced safely with user data

B A variable that stores user input

C A type of database table

D A WordPress plugin

Placeholders are symbols like %s or %d in queries replaced safely with user data.

Explain how WordPress prevents SQL injection using $wpdb and prepared statements.

Think about how WordPress separates code from data in queries.

Describe why directly inserting user input into SQL queries is dangerous and how to avoid it in WordPress.

Focus on the risks and the safe coding practice.