WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I put the following code in functions.php

function add_my_query_vars($qvars) {
  $qvars[] = "new_var";
  return $qvars;

add_filter('query_vars', 'add_my_query_vars');

If somebody requests my.site.com/?new_var=[MALICIOUS CODE], can they cause any damage? If not, why not?

Edit for clarity: I know that user input should be considered harmful. My question is whether WP vets the data that makes it into $wp_query.

share|improve this question
up vote 3 down vote accepted

Regardless of whether you registered new_var as a query_var, all GPC data (GET, POST, COOKIE) should be considered tainted. Basically, this data is user input. This means that you will need to clean and validate the data anyway.

Common cleaning methods include casting the variable to a certain type (like integer or string), using a regex to validate strings, etc. Also, if you are accessing $_GET data directly, don't forget to do an isset() or empty() check first to prevent "undefined index" notices.

Edit: In the first place, my answer applies to accessing GPC data via PHP's superglobals. That being said, if you use get_query_var() to retrieve your variable, as far as I see, you still need to clean the variables you registered yourself. WP will clean its standard query vars, of course. See the parse_query() function in wp-includes/query.php.

share|improve this answer
can you confirm that Wordpress definitely doesn't do any sanitization on variables that make it into the $wp_query? – djb Jan 6 '12 at 11:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.