Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am designing a frontend for users, where they can submit an article/post from. But i am worrying if someone puts javascipt code, or SQL injection, or other malicious code. Is there a plugin or some sort of scripts which can help me to filter the post contents from security point of view.

I'll appriate if someone can suggest me some code/script/plugin which can help to define rule over submmited contents like

  1. No. of external hyperlinks
  2. No. of Images
  3. Length of content etc.

Although i can do it manually. So the lower part of the question is less important.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

If your really worried I would probably create custom write panels or custom meta boxes tied into custom post types. That way you can make the custom post types based on user role and control what shows up very easily.

For instance you can make a custom post type called "tweens" with the user role of "contributor" so they can write posts but not submit them.

Using custom meta box's with a custom post type will give you complete control over what kind of data is submitted. For instance if you want to limit the above post type "tweens" to 5 images you only supply 5 image meta boxes, or limit the amount of words per text box, or strip urls or js, or remove the wysiwyg, etc ( anything really).

Some references:

http://codex.wordpress.org/Roles_and_Capabilities#Contributor http://codex.wordpress.org/Function_Reference/register_post_type http://codex.wordpress.org/Function_Reference/add_meta_box

share|improve this answer
add comment

You can use JQuery to validate the content of the front-end fields/text areas and if you find anything that looks like a code or other strings you can disable the post process. Also you can request the users to register first (before they get access to the post form). Also you can set the post status to draft or to an another category you want, before you approve it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.