In PHP 5.5 you had the function

mysql_real_escape_string()

and I always did

htmlspecialchars(mysql_real_escape_string($_POST['...]));

to secure against SQL-Injection.

With PHP 7 mysql_real_escape_string() is gone. An alternative is

mysqli_real_escape_string()

but that function needs a link to the mysqli object. When using WordPress to perform a query like this:

$query_args = array( 's' => $_POST['search'] );
$query = new WP_Query( $query_args );

I can’t provide a mysqli object. So Do I have to leave all the security stuff to WordPress? Is it enough to do:

$query_args = array( 's' => htmlspecialchars( $_POST['search'] ) );
$query = new WP_Query( $query_args );

?