1

The below query is always returning an empty array i have checked that the $_POST is working but i am unsure what is going on?

$database = new wpdb(QLBBackendUser, QLBBackendPass, QLBBackendDB, DB_HOST);  

if (isset($_POST['register-user'])):
    $user = $database->get_results('SELECT * FROM users WHERE email='.$_POST["user_email"]);
    var_dump($user);
endif;

Please note this is for Wordpress using WPDB Class.

1
  • 1
    You should never call the wpdb class directly...Use the global $wpdb object instead...Read more in the codex Commented Nov 12, 2015 at 10:08

1 Answer 1

2

You should never call the wpdb class directly...If you must, use the global $wpdb object instead. In addition, make sure the user_email has been POSTed (I'm not sure why you're checking for register-user being set and not user_email). Also, it's highly unlikely that the table you should be querying is called users (without a prefix). It's likely wp_users if you're using the default prefix.

Finally, there is a handy function that already does what you're trying to re-implement, called get_user_by:

$user = get_user_by( 'email', $_POST['user_email'] );

I recommend using the above, instead of trying to re-invent the wheel.

Sign up to request clarification or add additional context in comments.

4 Comments

In addition, I would only suggest if @Elevant wants to keep the custom query, they can rewrite it as follows: $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->users} WHERE email=%s", $_POST['user_email'] ) );. I believe it's important to point out the security hole that they had in their original query(using $_POST directly), even if it doesn't serve them now it is an important lesson to learn.
Are there security concerns in regards to calling wpdb directly? I have done it like that for a lot of pages. Also I didn't know about that function I should read more about them. Thanks
Also can you show me an example without calling wbdb directly? Or does it just mean to use the functions given like get user by function?
It's not unsafe to use the $wpdb object directly...however, it is unsafe to pass $_POST data directly to $wpdb. Instead you should sanitize this data, before passing it to $wpdb. And yes, using functions like get_user_by() is the way to do it withough $wpdb

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.