• thomas_ac

    (@thomas_ac)


    Hi Guys,

    i posted this thread on the troubleshoot forum. I figured, this topic fits here best. Here is my issue:

    i am looking to create multiple front end filters, for users to sort and filter through posts. I have created multiple custom taxonomies, which i would like to use for this matter. Very similirar to how you would sort through products in an e-commerce store.

    I have found this blog post, that has tipped me into the right direction on how to tackle this, but i have come across some concerns.

    If i use URL parameters to apply values to filter the query, how do i make sure i dont pick up some nasty scrips or code through the URL? Is there some WP core function that handles injections?

    Is using URL parameters a viable approach to this issue in the first place? Are there any other best practice methods on resolving this?

    I have looked into a couple of plug-ins on this topic that offer short code search forms, but none meet the implementation needs in order for me to create a userfriendly search form the way i want it. Anyhow, i am very open to plug-in suggestions as well.

    Update
    I also found this post, that pretty much sums up my concerns.

    http://www.joellipman.com/articles/web-development/503-basic-tests-for-sql-injection-vulnerabilities.html

    I would want to avaoid going through all that processing for each parameter value. How does WP handle input provided by the search form? Is there some third party framework, that i could use?


    Help much appreciated.
    Thomas

Viewing 1 replies (of 1 total)
  • RossMitchell

    (@rossmitchell)

    How does WP handle input provided by the search form?

    Well WP does not handle it, it is the plugin author who can/does/must code defensively. Note that plugins are intensively scrutinised in this regard, the plugin reviewers are experts at spotting vulnerabilities of this type.

    Is there some third party framework, that i could use?

    The wpdb class provides a method called “prepare”, more details here:
    http://codex.wordpress.org/Class_Reference/wpdb

Viewing 1 replies (of 1 total)

The topic ‘Security Concerns with Front End Filters for Posts’ is closed to new replies.