Preventing WordPress SQL Injection (SQLi)

Introduction: The Threat of SQL Injection

SQL Injection (SQLi) is consistently ranked in the OWASP Top 10 web vulnerabilities. In WordPress, SQLi occurs when a plugin or theme takes user input and passes it directly into a database query without proper sanitization or parameterization.

A successful SQL injection attack can allow an attacker to read the entire database, modify content, or create new administrative users, leading to a total site takeover.

The Anatomy of an Attack

Let's examine a real-world scenario. A custom plugin creates a product search feature but fails to sanitize the input.

$search_term = $_GET['search'];
// The input is concatenated directly into the query
$query = "SELECT * FROM wp_posts WHERE post_title LIKE '%" . $search_term . "%'";
$results = $wpdb->get_results($query);

An attacker can manipulate the search parameter by passing: ' UNION SELECT user_login, user_pass FROM wp_users --.

This alters the query to dump all usernames and password hashes to the screen.

Prevention: Prepared Statements

The only foolproof way to prevent SQL injection in WordPress is by using the $wpdb->prepare() method. This function acts as a prepared statement, ensuring that user input is treated strictly as data, never as executable code.

$search_term = $_GET['search'];
// Using %s as a placeholder for a string
$query = $wpdb->prepare("SELECT * FROM wp_posts WHERE post_title LIKE %s", '%' . $wpdb->esc_like($search_term) . '%');
$results = $wpdb->get_results($query);

Defense in Depth: The WAF

While developers should always write secure code, you cannot control third-party plugins. This is why a Web Application Firewall (WAF) is essential. A robust WAF intercepts HTTP requests and blocks SQL syntax (like UNION SELECT or SLEEP()) before the PHP script even executes.

Conclusion

SQL Injection is deadly but entirely preventable. By auditing custom code for prepared statements and deploying a strict WAF, you can eliminate this threat vector. Review our WordPress Security Checklist for a complete rundown of necessary protections.

About the Author: The Nexura Security Engineering Team continuously audits WordPress plugins for SQLi vulnerabilities, reporting findings via responsible disclosure. Updated: August 2026.