How to correctly escape query variables to be used in WP_Query

The function for the pre_get_posts action uses a WP_Query object (http://codex.wordpress.org/Plugin_API/Action_Reference/pre_get_posts) When using functions such as get_posts or classes such as WP_Query and WP_User_Query, WordPress takes care of the necessary sanitization in querying the database. However, when retrieving data from a custom table, or otherwise performing a direct SQL query on the database – proper … Read more

get_query_var function not working at all

WordPress doesn’t automatically add all query string params ($_GET params) as query_vars. When Query Var somevar is not registered: example.com/some-page/?somevar=hello – WordPress ignores somevar When Query Var somevar is registered: example.com/some-page/?somevar=hello – WordPress stores the value of this param in the $wp_query->query_vars array The difference between registering that variable with WordPress is whether the value … Read more