PHP SQL Injection - Is This Code Sufficiently "Safe" from That?

Question

I'm creating a fairly simple wordpress plugin and I feel the code below is sufficiently safe from SQL injection, but a friend of mine very vaguely said that it wasn't without elaborating and now I'm second guessing myself.

Is the following safe? What's below is literally the entire contents of, say for example, final.php and it is included in another file.

list($eid, $uid, $u, $an) = explode(';', base64_decode($_GET['q']), 4); $wp->insert(INFO_TABLE, array( 'eid' => $eid, 'uid' => $uid, 'u' => $u, 'an' => $an, ) ); header('Location: ' . $u);

See codex.wordpress.org/Class_Reference/… for the documentation and codex.wordpress.org/Class_Reference/wpdb#INSERT_rows for the notes on insert. — mario
– mario, Commented Jul 29, 2014 at 21:24
This question appears to be off-topic because it is asking for a code review — Quentin
– Quentin, Commented Jul 29, 2014 at 21:29

l'L'l · Accepted Answer · 2014-07-29 21:50:28Z

Yes, you're safe, using $wp->insert is enough, it passes through the API and it will handle the sanitization for you.

The good news is that if you use any of the helper functions, then you don’t need to do anything, the query is escaped for you. If you use the query() method, however, you will need to escape manually, using the prepare() method.

source: http://www.smashingmagazine.com/2011/09/21/interacting-with-the-wordpress-database/

David · Accepted Answer · 2014-07-29 22:58:21Z

Always validate any $_POST or $_GET submitted content. SQL injection in only 1 issue. At the very least someone could encode "buy viagra pills",etc,etc,etc and pass it unlimited amount of times to your database using the code above.

Collectives™ on Stack Overflow

PHP SQL Injection - Is This Code Sufficiently "Safe" from That?

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related