List of WordPress Sanitize functions or methods for DB query variables

When working with SQL database queries in WordPress, it’s essential to sanitize input data to prevent SQL injection vulnerabilities. WordPress provides several functions and methods for sanitizing database query variables. Here’s a list of commonly used ones:

1. $wpdb->prepare(): This method prepares a SQL query for safe execution by using placeholders and escaping variables. It’s the recommended method for sanitizing SQL queries in WordPress.
2. esc_sql(): This function is used to escape SQL queries. It ensures that data inserted into SQL queries is properly escaped, preventing SQL injection attacks.
3. sanitize_text_field(): This function is used to sanitize text fields. It removes invalid characters, such as control characters and line breaks, and ensures that the input is safe for database queries.
4. intval(): This function is used to sanitize integer values. It converts a variable to an integer, ensuring that only numeric values are used in SQL queries.
5. absint(): Similar to intval(), this function is used to sanitize integer values. It ensures that the value is converted to a non-negative integer.
6. esc_html(): This function is used to escape HTML entities. While it’s primarily used for outputting HTML content to prevent XSS attacks, it can also be used to sanitize input data for SQL queries in certain contexts.
7. esc_attr(): Similar to esc_html(), this function is used to escape attribute values in HTML tags. It can also be used for sanitizing input data for SQL queries in certain contexts.
8. esc_like(): This function is specifically designed for sanitizing values used in SQL LIKE queries. It escapes special characters used in LIKE clauses to prevent unexpected behavior.
9. wp_kses(): This function is used to sanitize HTML input by removing disallowed HTML elements and attributes. While its primary purpose is HTML sanitization, it can also be used in certain cases to sanitize input data for SQL queries.
10. wp_kses_post(): Similar to wp_kses(), this function is used to sanitize HTML input, but it’s tailored for post content. It allows a stricter set of HTML elements and attributes compared to wp_kses().
11. wpdb::prepare(): This method of the $wpdb class in WordPress is used to prepare SQL queries safely by escaping input variables and using placeholders.

Using these sanitization functions and methods appropriately in your WordPress code ensures that input data is properly sanitized before being used in SQL queries, thereby mitigating the risk of SQL injection vulnerabilities.