1

Can anybody do this please.

Now How can I remove backslash(\) from SQL?

Here I want to generate dynamic SQL query string. i can do this in procedural way. but here have some Security Risk because $postType is dynamic data.

$postType = array('post', 'product', 'page');
$strPostType = (string) implode("', '", $postType);

//Security Risk because $postType is dynamic data
//$sql = "SELECT `ID` FROM `cb_posts` WHERE `post_status` LIKE 'publish' AND `post_type` IN('" . $strPostType . "')";

 $sql = $wpdb->prepare("SELECT `ID` FROM `{$wpdb->prefix}posts` WHERE `post_status` LIKE 'publish' AND `post_type` IN('%s')", array($strPostType));
 //$results = $wpdb->get_results($sql, ARRAY_N);
 echo $sql;

Result:

SELECT `ID` FROM `cb_posts` WHERE `post_status` LIKE 'publish' AND `post_type` IN('post\', \'product')

Now How can I remove backslash(\) from SQL?

5
  • Your code is open to SQL injection related attacks. Please learn to use Prepared Statements Jul 19, 2020 at 11:35
  • @MadhurBhaiya I tried but not finding an IDEA.
    – Shapon Pal
    Jul 19, 2020 at 11:46
  • this doesn't work that way you have to have a placehoölder for every value in your array so check this answer stackoverflow.com/a/10501458/5193536 the second proposal
    – nbk
    Jul 19, 2020 at 11:55
  • This is possible for numeric values of array. But not possible for string values of array. IN (0,1,1,2,3,5,8,13)
    – Shapon Pal
    Jul 19, 2020 at 12:09
  • Need this IN('post', 'product') But Now generated IN('post\', \'product')
    – Shapon Pal
    Jul 19, 2020 at 12:10

0

Browse other questions tagged or ask your own question.