How to pass orderby params to $wpdb->prepare()?
You don’t need to use $wpdb->prepare() for ORDER BY clauses. $wpdb->prepare() will always quote your variables. Supposing you receive the ordering in the request, you can prevent SQL injection by not using the user entered value at all: $sql = “SELECT….”; if ( ‘asc’ == $_GET[‘order’] ) { $sql .= ‘ ORDER BY p.post_date ASC’; … Read more