SQL injection prevention with $wpdb

When to use this skill

Use this skill for any custom SQL that includes a dynamic value:

• $wpdb->get_results(), get_var(), get_row(), get_col(), query().
• WHERE, IN (...), LIKE, LIMIT, ORDER BY, table/column names.
• Custom tables, custom meta queries, reporting/analytics queries.

Prefer the high-level APIs (WP_Query, get_posts, get_users, $wpdb->insert/update/ delete) when they fit — they parameterize for you. Drop to raw SQL only when necessary, and then always via $wpdb->prepare().

Core principles (and why they matter)