WPZylos Database

Safe database access with QueryBuilder and prepared statements.

What You Get

• Connection — Wrapper around $wpdb with logging
• QueryBuilder — Fluent query construction with auto-prepare
• Table prefixing — Via context for isolation
• Table whitelist — Prevent SQL injection in identifiers

Quick Start

use WPZylos\Framework\Database\Connection;
use WPZylos\Framework\Database\QueryBuilder;

$db = new Connection($context);

// Raw queries (auto-prepares when args provided)
$users = $db->getResults(
    "SELECT * FROM {$table} WHERE status = %s", 'active'
);

// QueryBuilder (auto-prepares)
$builder = new QueryBuilder($db, $context->tableName('users'));
$active = $builder->where('status', 'active')->get();

Why Prepared Statements

All SQL must go through $wpdb->prepare().

// Bad: SQL Injection vulnerability
$db->query("SELECT * FROM users WHERE id = {$_GET['id']}");

// Good: Safe — Connection auto-prepares when args provided
$db->query("SELECT * FROM users WHERE id = %d", absint($_GET['id']));

Documentation

• Overview — Database architecture
• Installation — Setup
• Usage — Query patterns
• API Reference — Connection/QueryBuilder methods
• Examples — Real-world usage
• Testing — Testing database
• Security — Critical: SQL injection prevention
• Troubleshooting — Common issues

Related Packages

• wpzylos-migrations — Schema management
• wpzylos-core — Table prefixing via context