wpdb::insert will only ensure that data is inserted safely (i.e prevents against SQL injection). It will not sanitize your data (e.g. stripping certain/all HTML), that’s down to you.
You can either use wp_strip_all_tags, which removes all HTML, or a variation of wp_kses, which is a sophisticated library for removing certain (x)HTML tags & entitites.
The output of wpdb->last_query is:
You’ve been tricked! The reason you don’t see <script>alert(\'hello\')</script> is because it’s being parsed by the browser when you output it – if you escape your debug output you’ll see the two are the same:
<?php echo esc_html( $wpdb->last_query ) ?>
Related Posts:
- Should I use wpdb prepare?
- Is it mandatory to use $wpdb->prefix in custom tables
- $wpdb->insert_id
- Check for success of $wpdb->update() correctly
- WordPress and multithreading
- $wpdb->insert is changing a value
- Actions or filters fired when data is saved in a custom table
- Retrieving custom fields with $wpdb->get_results
- Really simple query giving error in SQL syntax
- Custom Plugin Database relations
- why creating tables using $wpdb is not being executed while installing plugins?
- How to use mysql IN statement with wpdb update method?
- Using $wpdb object in a widget
- Activation hook not creating table
- $wpdb -> Batch insert from XML File?
- How to Download and install plugin database remotely
- How to insert data to a database table when the field is not yet created?
- Where to store the name of a custom table?
- include wp-blog-header not working on MAMP
- creating custom function to log actions in plugin
- SQL query for custom taxonomy slugs
- Issue regarding $wpdb->prepare()
- Error on inserting a form value to database
- How to create database table, add data, update and delete using wpdb via plugins?
- Using WPDB to output raw XML fails because of wp-blog-header.php
- how to search users by ajax live search
- Adding custom end points, No error line
- Intermittent database errors when accessing WordPress database
- Storing data in wordpress database from ajax call from different website
- wpdb->prepare and mysql UPDATE – how is it done?
- $wpdb->prepare with LIKE and sprintf
- How to optimize multiple insert into wordpress database
- $wpdb->update() always need a second try
- Proper Prepare Statement for ALTER TABLE and using AFTER
- $wpdb->prepare is not working like mysql_real_escape_string
- How to avoid conflicts with db.php / $wpdb and other plugins that decide to use them?
- $wpdb in php 5.5
- Plugin to create Posts and Forums then choose category and parent forum
- $wpdb->update Issue
- How to relate the Category to user?
- WordPress database error: [Query was empty] – using $wpdb->prepare()
- Why doesn’t my Table get created?
- How to display specific data from a custom table to logged in users with a custom role
- $wpbd->insert_id is returning null
- How to store sensitive user data (passwords)
- How to get inserted row IDs for bulk/batch insert with wpdb query?
- WordPress Query doesn’t return the correct value
- User avatar-ACF fields
- bindParam? WordPress 4.9.5 SQL LIKE statement %s and %LIKE%
- Update database record in plugin
- Dedicated server and WPDB Class : huge slow-down of the website
- How to implement pagination into a wpdb->result query?
- How to CRUD from wordpress database in wordpress theme?
- I can’t write in my DB using $wpdb->insert
- $wpdb how can i save my postmeta table before querying it
- WordPress plugin tables become corrupt
- Nothing happens on WordPress Update command
- Fixing plugin for wpdb::prepare
- multiple record insert creating many duplicate records
- Objective Best Practices for Plugin Development? [closed]
- add_menu_page() with different name for first submenu item
- Autoloading & Namespaces in WordPress Plugins & Themes: Can it Work?
- How to include PHP files in plugins the correct way
- How can I add an image upload field directly to a custom write panel?
- A tool to analyze rewrite rules? [closed]
- Difference Between Filter and Action Hooks?
- framework for plugin/theme options panel? [closed]
- Creating a table in the admin-style?
- How can you check if you are in a particular page in the WP Admin section? For example how can I check if I am in the Users > Your Profile page?
- Settings API with arrays example
- How to get the path to the current theme?
- How to make a plugin require another plugin?
- ajaxurl not defined on front end
- What process do you use for WordPress development? [closed]
- What’s the difference between term_id and term_taxonomy_id
- Why does WordPress use outdated jQuery v1.12.4?
- Post meta vs separate database tables
- Is there any plugin development framework
- Is it possible to reuse wp.media.editor Modal for dialogs other than media
- How to add a javascript snippet to the footer that requires jQuery
- Enhance Media Manager for Gallery
- How do I create a custom role capability?
- How do I add CSS options to my plugin without using inline styles?
- How do i best handle custom plugin page actions?
- Adding Custom Text Patterns in the WP 4.5 Visual Editor
- Automatically determine minimum WordPress version required for a plugin?
- What is the advantage of using wp_mail?
- How to make a WordPress plugin translation ready?
- How many times will this code run? (or, how rich is grandma?)
- How to create an API for my plugin?
- Is it ever okay to include inline CSS in plugins?
- Plugins in symlinked directories?
- How to override existing plugin action with new action
- How to include a file using get_template_part() in a plugin?
- Add custom TinyMCE 4 Button, Usable since WordPress 3.9-beta1
- How to store username and password to API in wordpress option DB?
- body_class hook for admin pages
- “Error: Options Page Not Found” on Settings Page Submission for an OOP Plugin
- Which hook should be used to add an action containing a redirect?
- add_action hook for completely new post?