为何WordPress的wpdb->prepare会将%转换为随机GUID？

Let me break this down clearly—this is a super common gotcha with WordPress's wpdb class, so you're definitely not alone here!

Why Does wpdb->prepare Turn % into a Random GUID-like String? #

WordPress's wpdb->prepare is built first and foremost for SQL injection protection. Here's the non-negotiable rule it follows:

• Every single % in your query must either be a valid placeholder (like %s for strings, %d for integers, %f for floats, or %i for table/column names) paired with a corresponding parameter, or escaped as %% to represent a literal percent sign.

If you leave a lone % in your query without a matching parameter or proper escaping, wpdb doesn't throw an immediate error—it replaces that unpaired % with a random unique string (looks like a GUID) as a safety fallback. This prevents accidental SQL injection risks or invalid SQL syntax that could crash your site. That's exactly what threw you off earlier!

Correctly Querying Your Custom Table for Multiple Columns & Records #

Now, for your actual goal: pulling multiple columns and potentially multiple records from your custom WordPress table. Here's how to do it the right way, following WordPress best practices:

Example 1: Basic Query (No Dynamic Filters) #

If you just need to fetch specific columns from all records in your custom table:

global $wpdb;
// Always use $wpdb->prefix to keep your table names consistent with the site's prefix
$custom_table = $wpdb->prefix . 'your_custom_table_name';

// No dynamic values here, so we don't strictly need prepare—but it's still safe to use
$results = $wpdb->get_results(
    "SELECT column_name_1, column_name_2, column_name_3 FROM {$custom_table}"
);

// $results will be an array of objects, where each object represents a row
foreach ($results as $row) {
    echo $row->column_name_1;
}

Example 2: Query with Dynamic Filters (Use prepare!) #

If you're adding dynamic values (like a user ID, post ID, or search term), always use wpdb->prepare with proper placeholders:

global $wpdb;
$custom_table = $wpdb->prefix . 'your_custom_table_name';
$target_user_id = get_current_user_id(); // Example dynamic value

$query = $wpdb->prepare(
    "SELECT column_a, column_b FROM %i WHERE user_id = %d",
    $custom_table, // %i is for table/column names (special placeholder)
    $target_user_id // %d matches the integer user ID
);

$user_records = $wpdb->get_results($query);
// Now $user_records holds all rows matching the user ID, with your desired columns

Example 3: If You Need Literal Percent Signs in Your Query #

If your SQL needs a literal % (like a percentage value), escape it with %%:

$query = $wpdb->prepare(
    "SELECT * FROM %i WHERE discount_percent > %f%%",
    $custom_table,
    25.5 // This will become "discount_percent > 25.5%" in the final SQL
);

Quick Recap to Avoid Future Headaches #

• Never leave unescaped % characters in your wpdb->prepare queries—use %% for literal percents, or pair %s/%d/%f/%i with corresponding parameters.
• Always use $wpdb->prefix for your custom tables to play nice with WordPress's multisite setup and standard conventions.
• Use $wpdb->get_results() when you expect multiple rows (returns an array of objects), or $wpdb->get_row() for a single row.

内容的提问来源于stack exchange，提问作者zpert