title: How to prevent SQL Injection in Wordpress?
body: <p>I'm currently using the following query to get values in mysql using php:</p>
  
  <p>The code is working, but now I'm worried about sql injections.</p>
  
  <p>How to prevent SQL injection?</p>
  
  <pre><code>&lt;?php include_once("wp-config.php");
  @$gameid = $_GET['gameid'];
  
  global $wpdb;
  $fivesdrafts = $wpdb-&gt;get_results( 
      "
      SELECT ID
      FROM $wpdb-&gt;posts
      WHERE  ID = ".$gameid." 
  
      "
  );
  ?&gt;
  </code></pre>
  
  <p>is this safe?</p>
  
  <pre><code>&lt;?php include_once("wp-config.php");
  @$gameid = mysql_real_escape_string($_GET['gameid']);
  
  global $wpdb;
  $fivesdrafts = $wpdb-&gt;get_results(
  $wpdb-&gt;prepare(
      "
      SELECT ID
      FROM $wpdb-&gt;posts
      WHERE  ID = %d", ".$gameid.")
  );
  ?&gt;
  </code></pre>