What can I do to get actual prepared statements in Wordpress

Question

My company wants to use WordPress for its website, and my main problem is using prepared statements. According to this , and I myself read the source code in disbelief, WordPress sanitizes the string, but <base> not .

Is there anything I can do to get the real thing? Or are my fears unfounded?

Answer 1

Story

, wpdb, Justin Vincent ezSQL library, 2003 , , MySQL PHP API : WordPress, , , , , SQL.

ezSQL (, , WordPress) PHP mysql_escape_string(), , (, PHP ).

WordPress SQL- , ( ) addslashes() - , mysql_real_escape_string() ( wpdb::prepare() )!

, WordPress , (.. MySQLi): , @naththedeveloper , # 21663 , .

Status Quo

, MySQLi wpdb, ( ), WordPress ( , / wpdb ).

-, , ?

, , / , , , .

?

( , SQL- ), . SQL- ( , , PDO , , wpdb::prepare() ) ...

Answer 2

MySQLi . https://core.trac.wordpress.org/ticket/42352