Track 02

🗄️ SQL Injection

On WordPress this almost never lives in core — it lives in plugins and themes that build SQL strings by hand. Flip the breaker to swap a raw concatenated query for a parameterized $wpdb->prepare() call.

Search query builder

RAW CONCATPREPARE()

MODE

// User input: ' OR '1'='1
$sql = "SELECT * FROM wp_users WHERE user_login = '$username'";
$wpdb->get_results($sql);

-- resulting query --
SELECT * FROM wp_users WHERE user_login = '' OR '1'='1'// Same input, parameterized
$sql = $wpdb->prepare(
    "SELECT * FROM wp_users WHERE user_login = %s",
    $username
);
$wpdb->get_results($sql);

-- resulting query --
SELECT * FROM wp_users WHERE user_login = '\' OR \'1\'=\'1'

Safe query checklist

Every $wpdb->query() / get_results() / get_row() / get_var() with a variable goes through prepare().
DB user has least-privilege grants — no DROP/GRANT from the app account.
Disable verbose SQL error output in production.
Audit third-party plugins for raw query concatenation before installing.
WAF rules as a second layer, not a replacement for fixing the query.