Prepared Statements on Query Fragments?

  • I’m building a very advanced search form that will access a custom database table. The methodology I’m using is as follows:

    Form > isset() function for each field > query built using variables set by the isset() functions.

    To protect the database, I’m currently running prepare statements like this during the isset() phase:

    if (isset($_POST[‘address’])) {
    $displayaddress = $wpdb->prepare(” and display-address LIKE ‘%%%s%%'”, $_POST[‘address’]);

    } else {

    $displayaddress = ”;
    }

    Is this the proper way to go about building a secure query constructed from isset() function output variables? Does it matter if the prepared statement lacks any “Select …. From…” text?

  • The topic ‘Prepared Statements on Query Fragments?’ is closed to new replies.