Wordpress - insert as prepared query vs $wpdb->insert_id
Using $wpdb->insert() and $wpdb->update() you are implicitly using $wpdb->prepare() function and its protection.
For example the WordPress $wpdb->update() function has in the final two lines:
$sql = "UPDATE `$table` SET " . implode( ', ', $bits ) . ' WHERE ' . implode( ' AND ', $wheres );return $this->query( $this->prepare( $sql, array_merge( array_values( $data ), array_values( $where ) ) ) );So, to get the inserted ID and be protected, I recommend you use $wpdb->insert().