Comment by winstonwinston

Quick search shows this in Wordpress:

> WordPress database access abstraction class.

  class wpdb {}

So this is some sort of ORM provided.

  $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT );

> Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below.

It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.