SQL injection prevention in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely prepare a SQL query using WordPress functions.

Wordpress

$wpdb->prepare("SELECT * FROM wp_users WHERE ID = [1]", $user_id);

Drag options to blanks, or click blank then click option'

A%x

B%d

C%s

D%f

Attempts:

3 left

💡 Hint

Common Mistakes

Using %s for integers causes errors or unsafe queries.

Not using prepare() leads to SQL injection risks.

Use %d to safely insert an integer value in the query.

2fill in blank

medium

Complete the code to safely insert a string value into the database using WordPress.

Wordpress

$wpdb->prepare("SELECT * FROM wp_posts WHERE post_title = [1]", $title);

Drag options to blanks, or click blank then click option'

A%x

B%f

C%d

D%s

Attempts:

3 left

💡 Hint

Common Mistakes

Using %d for strings causes errors or unsafe queries.

Not using prepare() leads to SQL injection risks.

Use %s to safely insert a string value in the query.

3fill in blank

hard

Fix the error in the code to prevent SQL injection by using the correct WordPress function.

Wordpress

$wpdb->query([1]);

Drag options to blanks, or click blank then click option'

A$user_login

B$wpdb->escape($user_login)

C$wpdb->prepare("SELECT * FROM wp_users WHERE user_login = %s", $user_login)

D$wpdb->prepare($user_login)

Attempts:

3 left

💡 Hint

Common Mistakes

Using variables directly in the query string.

Using deprecated or incorrect escaping functions.

Use $wpdb->prepare("SELECT * FROM wp_users WHERE user_login = %s", $user_login) to safely insert the string and prevent SQL injection.

4fill in blank

hard

Fill both blanks to safely update a post title using WordPress functions.

Wordpress

$wpdb->query($wpdb->prepare("UPDATE wp_posts SET post_title = [1] WHERE ID = [2]", $new_title, $post_id));

Drag options to blanks, or click blank then click option'

A%s

B%d

C%f

D%x

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up placeholders causes errors or unsafe queries.

Not using prepare() leads to SQL injection risks.

Use %s for the string title and %d for the integer post ID.

5fill in blank

hard

Fill both blanks to safely select posts with a minimum comment count using WordPress prepare.

Wordpress

$wpdb->get_results($wpdb->prepare("SELECT * FROM wp_posts WHERE comment_count [1] [2]", $min_comment_count));

Drag options to blanks, or click blank then click option'

A>

B>=

C%d

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong comparison operators.

Not using placeholders for variables.

Use >= to select posts with comment count greater or equal, and %d as the placeholder for the integer value.