31.05.2015, 20:30
I know you fixed it but keep in mind that the output of WP_Hash will always be between 0-9 and A-F so there isn't any reason to escape the string. Any other input by user (strings) - yes, escape them to avoid SQL Injection.