To construct dynamic sql queries to have to string concatenate at least some parts, .
User data should of course be passed via prepared statements.
To construct dynamic sql queries to have to string concatenate at least some parts, .
User data should of course be passed via prepared statements.
One usually uses "query builder" pattern for that.
Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
ORMs and query builders ARE concatenating strings.
Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
Quick search shows this in Wordpress:
> WordPress database access abstraction class.
So this is some sort of ORM provided. > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below.It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.