SQL Injection Prevention with Contact Form 7 Data

SQL Injection Prevention with Contact Form 7 Data — a practical guide to Contact Form 7 SQL injection with clear examples you can reuse in real projects.

Contact Form 7 Tutorial Series (93/100). Prefer one article? Read the complete Contact Form 7 tutorial.

Short description

Never concatenate raw posted strings into SQL.

Safe query

$wpdb->get_results($wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}acme_cf7_leads WHERE email = %s",
    $email
));