$wpdb->prepare
shouldn’t make any significant difference. As you can see here (https://developer.wordpress.org/reference/classes/wpdb/prepare/#source), it doesn’t do much. It’s just taking care of proper escaping and formatting variables, so the final query is safe to run.
So if you’re asking if there is a big difference between $wpdb->query( $wpdb->prepare( ... ) )
and $wpdb->query( <SAFE_SQL> )
, then no – there is no such difference, because you’ll have to prepare the <SAFE_SQL>
query by yourself, so you will make something very similar to prepare
function.
And as for your points:
-
I don’t really think it’s harder to read. For me it’s even easier, because I clearly see what type of variables go to the query, and what values are passed in there. Of course formatting, naming, and so on are very important to make the code readable.
-
No, running
prepare
shouldn’t make a noticeable difference. But… If you have 500 queries, then you should take a look at them, because it’s really a lot of queries. -
Why isn’t it suitable for dynamic queries? There are a lot of dynamic queries in WP and all of them are constructed with
prepare
method. Just take a look atWP_Query::get_posts
method – it’s called almost everywhere in WP and it constructs highly dynamic query, based on many parameters and additional filters… -
Yes, there is. Validation is one thing. Escaping is another thing. And sanitization is another one. Every one of these steps is important for your site safety.