Q: How do I prevent SQL injection in custom table queries?

Use the $wpdb methods for ordinary inserts, updates and deletes, and use $wpdb->prepare() for custom SQL. Match placeholders to values and never concatenate untrusted input into a query. Table and column names need separate handling: use a fixed allow-list, or the identifier placeholder where the site’s WordPress version supports it.

Q: Why is dbDelta() not updating my custom table correctly?

dbDelta() only recognises particular SQL patterns, so formatting and declarations matter. Common trouble spots include empty lines, inconsistent data-type case, index definitions and column declarations that differ from what the database reports. Run it only during activation or a versioned upgrade, inspect its return values and verify the result on the target MySQL or MariaDB version.

Question 1

Should custom data use a WordPress table or post meta?

Accepted Answer

Use post meta when the data belongs naturally to posts and does not need a separate relational structure. Use a custom table for large datasets, frequent structured queries, logs or relationships that would become awkward in post meta. WordPress specifically recommends considering post meta before creating a new table, because a custom table requires its own schema and upgrade process.

Question 2

Where should a custom table be created?

Accepted Answer

Create it from a plugin activation routine, using the site’s $wpdb->prefix and a namespaced table name. Load WordPress’s upgrade functions and use dbDelta() for the initial schema and controlled changes. Do not create or alter the table on every request, because repeated migrations can cause locks, slow requests and endless alteration loops.

Question 3

How do I prevent SQL injection in custom table queries?

Accepted Answer

Use the $wpdb methods for ordinary inserts, updates and deletes, and use $wpdb->prepare() for custom SQL. Match placeholders to values and never concatenate untrusted input into a query. Table and column names need separate handling: use a fixed allow-list, or the identifier placeholder where the site’s WordPress version supports it.

Question 4

Why is dbDelta() not updating my custom table correctly?

Accepted Answer

dbDelta() only recognises particular SQL patterns, so formatting and declarations matter. Common trouble spots include empty lines, inconsistent data-type case, index definitions and column declarations that differ from what the database reports. Run it only during activation or a versioned upgrade, inspect its return values and verify the result on the target MySQL or MariaDB version.

Question 5

Can I manage custom tables without writing PHP?

Accepted Answer

Yes, but the best route depends on the job. A database tool can handle a one-off SQL change, while a dashboard editor is safer for repeated row edits, bulk changes and CSV work. For a custom application with permissions, validation, migrations and business rules, you still need code or a plugin that provides those controls rather than editing the database directly.

How to manage custom tables in WordPress

What you need

Let WP Sheet Editor Custom Tables Pro do it

Sources

Questions