Sanitatizing when using the posts_where hook

2 Views

I am altering the WordPress query, using the posts_where hook, when a (custom) query variable is set as follows: 

add_filter('posts_where', 'my_posts_where' );
function my_posts_where( $where ){
    global $wp_query;

    if( isset( $wp_query->query_vars['customvar'] )) {
        $custom_Var = $wp_query->query_vars['customvar'];
        $where .= " AND wp_MyTable.Column ='".$custom_Var."' ";
    }
    return $where;
}

This works well, but I want to sanitize it. In particular, I’ve tried using $wpdb->prepare() method:

Read More
$where .= $wpdb->prepare(" AND wp_MyTable.Column = %s", $custom_Var);

But this doesn’t work (I just get a blank page). Why is this and is there another / better way of sanitizing the variable?

Post Views: 2

Related posts

Leave a Reply

1 comment

  1. Your last prepare() snippet should work just fine, check that you have $wpdb declared as global in your function.

    Also blank page seems extreme, enable WP_DEBUG if not yet and see if there are any specific errors that cause it.