If not, how do I clean the incoming variables?
In most cases you don’t, get_posts calls WP_Query internally, and WP_Query performs some sanitization, namely via wpdb->prepare.
However, for what you’re trying to do, this is the wrong approach. Just use a standard search.php template with a standard post loop, and use input fields that have the same names as the parameters for WP_Query. WP will automatically filter as a result of them being added to the URL. There is no need for a custom page template with a custom query and custom URL parameters. It’s just unnecessary complexity, and double the database queries ( don’t forget the broken pagination, dealing with 404’s, etc )
Related Posts:
- $wpdb is get_results escaped
- Counting posts with argument without retrieving the posts
- How to protect a script execution on WordPress?
- SQL queries to another wordpress site
- Escaping a WPDB Object in One Shot
- How to parse row results from $wpdb -> get_results
- Fetch array with $wpdb
- get_results on large datasets
- $wpdb->insert() and Values for Datetime Columns?
- Theoretical Multi-Server WordPress Setup with Shared Users
- Change post status based on meta value
- Speed optimization of $wpdb->get_results
- WordPress insert NOW() in TIMESTAMP column returns all zeros
- How do you use prepare when asking for a list of id’s
- $wpdb prepare issue with mysql DATE_FORMAT
- How-To: wpdb Insert Record With Date
- How to pass NULL in where array for $wpdb->update
- Get random row from custom table
- store custom WP table names in a global variable
- wpdb prepare: passing varible number of fields as second argument
- I am not understandinhg $wpdb->prepare correctly
- Wpdb query for comment meta for current post
- How to Modify this $wpdb query to accept an array of post statuses
- Using WPDB class
- WPDB Update using Conditional Arrays
- $wpdb->get_results returns empty but value exists
- WP Sql query multiple where clause
- Problem displaying inserted form
- What is _transient_random_seed for?
- Get published posts and pages?
- wpdb get_results() and prepare when to use prepare?
- Syntax for $wpdb->prepare when searching in two columns
- Foreach loop using $wpdb not results from rows
- $wpdb->insert is running multiple times on page load, but only called once
- Confused by $wpdb->prepare
- How to get a value-only flat array from $wpdb->get_results when selecting a single column, without foreach()?
- How to Instantiate wpdb Object in New File
- How do you build a wpdb query dynamically?
- Would this WPDB setup result in potential race conditions?
- How to update a row in a table in WordPress
- What’s the proper way to add users to my site in order to test things?
- Optimizing WordPress Queries – Removing Group By ID
- External DB Connection [closed]
- Codex: Database Description: meaning of Cardinality
- Code only works every other time its run
- Can’t pass variable in wordpress wpdb->get_results
- WordPress db prepare
- How do I count columns on a custom WPDB query?
- how to get db values without using an loop with wpdb->get_results()
- Custom SQL query ORDER BY term_order
- Trouble inserting string containing quotations marks with wpdb in save_post hook
- How to run wp_insert_post() & wpdb on the background?
- Trying to get variable from WP table and toggle its value
- Set MySQL variables in WPDB
- get_results query with accent
- How to prepare an array of values with $wpdb
- Is querying wpdb directly and skipping actions provided by WP’s core “wp_update_post” a good idea?
- $wpdb->insert() doesnt work anymore
- $wpdb query outputs php code instead of executing it
- wpdb query not working
- Where can I see MySQL hostname and port for wp-config.php
- WordPress wpdb->insert returns int(0) => doesn’t insert anything, no errors!
- Using “->” in a page to exceute $wpdb query gives error
- Unknown column ‘siteurl’ in ‘where clause’ WPDB outside
- Exclude specific terms from all queries using posts_where or something similar
- $wpdb->get_results not returning an array
- query a newly created table using $wpdb
- Get all sticky posts from one user through user ID
- WPDB Query Question with Category Only
- wpdb result arrray inside an array
- $wpdb->num_rows doesn’t work
- How can I change my meta_query to SQL wpdb query?
- How capturate wpdb exceptions?
- Insert NULL value using prepare()
- “This message was added in version X” showing a later version than current one
- Prepare WPDB with meta key and meta value
- How to get row value from wpdb
- I am using wpdb but it not working perfectly.but if I dont use form data its work
- wont add form details to database or send me mail
- Create a stored procedure on plugin activation
- Get last element from wpdb as a string
- WPDP related functions look to work but they don’t
- Custom database query to validate data
- Update all fields of table with ON DUPLICATE KEY UPDATE command
- WordPress – wpdb query does not list same result as sql query
- Protect custom form from SQL injection
- why nl2br() is adding an extra ?
- What is the best practice to initialise $wpdb by loading wp-load.php?
- $wpdb->get_results in not an array
- How to make iteration on wpdb->update or query statement?
- How to add more custom fields in user meta table simultaneously
- get unserialized array without using get_option()
- SQL Query to select post title & post ID from a particular category
- Create Table Failed Column Date DateType
- Checking if meta_value exists for any user
- Jeditable Plugin working as it should – scope issue?
- Can you create a new wpdb that connects to an SQL (not MYSQL) database? [duplicate]
- query using wpdb in wordpress gets me no result
- Site going down due to slow queries
- How do I change the datetime format from ( ‘y-m-d’ ) to ( ‘d m y’ ) [closed]