Replacing mysql_escape_string in a custom plugin when moving to PHP7
You don’t need to sanitize the variables that are passed to wp_update_post() because wp_update_post() after some checks pass the data to wp_insert_post() and wp_insert_post() calls sanitize_post(), which does the sanitization of all arguments. Also add_post_meta and update_post_meta also do all the sanitization for you. To answer your question I would replace mysql_escape_string with $wpdb->esc_sql($_POST[$value]). It … Read more