[tyingq]

>Also $wpdb->prepare() uses parametrised values.

They appear to be a hand-rolled PHP version of imitation client-side parameterized values, not the actual database library ones.

https://github.com/WordPress/WordPress/blob/master/wp-includ...

[berkle4455]

Wow. That is so much code just to avoid calling mysqli_prepare(). And they insist on using a weird printf inspired syntax instead of ? or :field.

[tyingq]

I suppose it's pretty battle-hardened by now, but I'd be afraid to ever touch that code for fear of introducing a SQL injection.