When a WordPress plugin or theme needs to talk to the database directly, it uses the core-provided global object $wpdb . The one thing to absolutely avoid when doing so is dropping user input straight into a SQL string through concatenation. The tool WordPress provides instead is $wpdb->prepare() . This post looks at why that matters and what the function actually does under the hood. Note: SQL injection is a broad term for attacks where unexpected input gets mixed into a SQL statement...