To construct dynamic sql queries to have to string concatenate at least some parts, .

User data should of course be passed via prepared statements.

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.