Preventing SQL Injection — a practical guide to WordPress SQL injection with clear examples you can reuse in real projects.
WordPress Plugin Development Series (73/95). Prefer one article? Read the complete WordPress plugin development tutorial.
Short description
Never concatenate unsanitized user input into SQL. Prepare values; allowlist column/orderby names.
Safe query
$rows = $wpdb->get_results(
$wpdb->prepare("SELECT * FROM {$wpdb->prefix}acme_items WHERE title LIKE %s", '%' . $wpdb->esc_like($q) . '%')
);