Does using the WordPress get_results() database function prevent sql injection

Viewed 2357

Couldn't seem to find a answer but wondering if the following query to the database is vulnerable to sql injection.

$searchPostResults = $wpdb->get_results($querySearchVals, OBJECT);

This is the query which is used:

global $wpdb;
$offset = (isset($_POST["moreSearchResults"])) ? $_POST["searchOffset"] : 0;

$querySearchVals = "
    SELECT DISTINCT post_title, ID
    FROM {$wpdb->prefix}posts
    WHERE (";

$sVals = array();
$sVals = explode(" ", $searchVal);

$lastIndex = intval(count($sVals)) - 1;
$orderByCaseVals = "";
for($i = 0; $i<count($sVals);$i++)
{
    $querySearchVals .= " post_title LIKE '%$sVals[$i]%' ";
    if($i != $lastIndex)
        $querySearchVals .= " OR ";

    $orderByCaseVals .= " WHEN post_title LIKE '%$sVals[$i]%' THEN ($i + 2) ";
}

$querySearchVals .= ") 
    AND {$wpdb->prefix}posts.post_type = 'post'
    AND post_status = 'publish' 
    ORDER BY CASE
        WHEN post_title LIKE '%$searchVal%' THEN 1
        $orderByCaseVals
    END
    LIMIT $offset, 6;
";

Cheers

1 Answers
Related