Why WordPress Developers Should Use $wpdb->prepare() Instead of String Concatenation

·1 views

WordPress plugins and themes that query the database through the global $wpdb object should never insert user input directly into SQL strings. Doing so opens the door to SQL injection, where crafted input can alter a query's logic and expose more data than intended. The recommended safeguard is $wpdb->prepare(), which uses typed placeholders to escape values before they are inserted into the statement. Choosing the right placeholder, such as %s for strings, %d for integers, or %f for floats, also ensures values are treated as the expected type. The article further notes that LIKE clauses need extra care, since wildcard characters in search terms can still change query behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Cloudflare's Clairic Model Returns Null Values Rather Than Guesses, Developer Warns

A developer's hands-on review of Cloudflare's Clairic, a preview extraction model on Workers AI released October 19, found that it correctly returns null when an input lacks a requested field. However, its response also includes a 'guess' key that can contain a plausible but wrong value, such as an invoice number placed in a purchase order field. Clairic is described as a single-pass model that produces field values without generating text and costs $0.10 per million input tokens. The author notes that Cloudflare has not documented what the confidence score means when the value is null, and that the weights are not yet public and the model is offered 'AS IS'. The article recommends gating each scalar field with thresholds on null probability and confidence before using the output in data pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Domain loss after a registrar account freeze exposes the limits of digital asset ownership

A widely discussed post reported that a registrar disabled every domain under one account even though invoices were paid, showing how quickly access can be removed. The commentary argues that customers typically hold a revocable license and login access rather than true title to domains, app listings, payment accounts, and cloud projects. Unilateral abuse flags, trademark complaints, or fraud heuristics can freeze assets with little notice, leaving the burden of proof on the account holder. Because registrar, DNS, email, and hosting often sit in one account, a single action can cascade into loss of identity and recovery channels. The piece recommends keeping exportable backups, separate credentials, and independent DNS providers so control can be relocated without the cooperation of the party that might freeze access.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Voice AI for Beginners: A Guide to Text-to-Speech and Voice Cloning

This developer guide introduces Voice AI, focusing on text-to-speech (TTS) and voice cloning as entry points for hobbyists and early-stage projects. It contrasts traditional TTS, which sounds mechanical, with neural TTS models such as Tacotron, WaveNet, and FastSpeech, which produce more natural and expressive speech at higher compute cost. Open-source options like Coqui TTS are suggested for prototyping, while commercial APIs are recommended for production use. The article outlines the voice cloning workflow of data collection, feature extraction, model training, and inference, and highlights ElevenLabs as a managed service with Python and JavaScript SDKs and a free tier. Code examples show how to generate speech through its API.

0 comments Read more at DEV Community

ProgrammingHacker News ·

French Supermarket Fridges Left Exposed Online for Months, Report Finds

A security analysis published on the ipinfo.io blog reports that refrigerators used in French supermarkets were accessible over the internet for an extended period. The vulnerability reportedly persisted for months before being identified. The write-up is discussed on Hacker News, where it has drawn a modest amount of attention. The original article text was not included in the source material, so the specific technical details, affected vendors, and remediation steps cannot be confirmed here. Readers are directed to the original blog post for full findings.

0 comments Read more at Hacker News