title: Wordpress wpdb->prepare sql string from form
body: <p>I'm currently using a custom wordpress table to store an external xml feed and this information needs to be filterable by a basic html form with several options.</p>
  
  <p>What is the best way to go about this and build the string using <code>wpdb-&gt;prepare</code>? I'm using the below for my pagination and the $user_query is currently set to  <code>$user_query .= "AND</code>query1<code>LIKE $query1 ";</code> etc. </p>
  
  <p>However i feel like this could lead to problems as i'm not doing it through the second parameter such as <code>%d</code>, <code>$variable</code> etc.</p>
  
  <pre><code>//Get Results
  $results = $wpdb-&gt;get_results(
      $wpdb-&gt;prepare("SELECT * FROM `feed` WHERE `price` != 0 $user_query  LIMIT %d,
         %d", $offset, $items_per_page, OBJECT)
    );
  </code></pre>
  
  <p>I hope the above makes sense. I'm just trying to build the SQL query from the form <code>$_GET</code> values with no SQL injection issues.</p>
  
  <p>Many thanks</p>