Ok, comme l'a expliqué tadman, get_results n'empêche pas l'attaque par injection sql.
la fonction de préparation doit être utilisée.
J'ai réécrit le code ci-dessus pour empêcher l'injection sql :
global $wpdb;
$offset = (isset($_POST["moreSearchResults"])) ? $_POST["searchOffset"] : 0;
$querySearchVals = "
SELECT DISTINCT post_title, ID
FROM {$wpdb->prefix}posts
WHERE (";
$sVals = array();
$sVals = explode(" ", $searchVal);
$lastIndex = intval(count($sVals)) - 1;
$orderByCaseVals = "";
for($i = 0; $i<count($sVals);$i++)
{
$queryPrep = $wpdb->prepare(" post_title LIKE '%%%s%%' ", $wpdb->esc_like( $sVals[$i] ));
$querySearchVals .= $queryPrep;
if($i != $lastIndex)
$querySearchVals .= " OR ";
$queryPrep = $wpdb->prepare(" WHEN post_title LIKE '%%%s%%' THEN ($i + 2) ", $wpdb->esc_like( $sVals[$i] ));
$orderByCaseVals .= $queryPrep;
}
$querySearchVals .= ")
AND {$wpdb->prefix}posts.post_type = 'post'
AND post_status = 'publish'
ORDER BY CASE";
$queryPrep = $wpdb->prepare(" WHEN post_title LIKE '%%%s%%' THEN 1 ", $wpdb->esc_like( $searchVal ));
$querySearchVals .= $queryPrep;
$querySearchVals .= "
$orderByCaseVals
END
";
$queryPrep = $wpdb->prepare(" LIMIT %d, 12", $offset);
$querySearchVals .= $queryPrep . ";";