Admin: Custom Query Returning Permissions Error

Question

Our current WordPress install has a few custom tables we've placed into the WP database that hold misc. information. We've created custom option pages for the WP admin panel for our WP admin users to be able to access the information from the DB through the admin.

One option we want is for users to be able to delete some of these records through the WP admin panel, so I've initially setup a custom query to just UPDATE or DELETE the records from the table. However, when I try to submit the query, WP returns the error: "You do not have sufficient permissions to access this page.".

Should I be avoiding the MySQL query "UPDATE table_name... etc."?

Answer 1

I think the problem is that by just appending ?deleteUser=XX you get an 'illegal' url, for example:

http://localhost/wordpress/wp-admin/edit.php?post_type=type&page=mypage?deleteUser=xxx

Instead, use WordPress' add_query_arg:

    $url = $_SERVER['REQUEST_URI'];
    $url = add_query_arg('test','val',$url);

which gives:

http://localhost/wordpress/wp-admin/edit.php?post_type=type&page=mypage&deleteUser=xxx

Personally, I wouldn't use $_SERVER['REQUEST_URI']; and instead hard-code the url of the page using admin_url. Also, see @Joshua comments on using the WordPress in-built functions which handle sanitization of your SQL statements.

Final point, you will want to perform nonce-checks (as well permission checks - should the current user be able to delete/modify table?). For the nonce-check you can do:

 $url = wp_nonce_url( $url, 'my-nonce-action' );

to add the nonce to the url the user is directed to. Then prior to deleting/modifying anything, use wp_verify_nonce to verify the nonce.

Answer 2

Not sure about the permissioning, without more info, but you may want to try this: http://codex.wordpress.org/Class_Reference/wpdb#UPDATE_rows

Essentially its use is summed up as this:

<?php
    global $wpdb;
        $update_array = array(
            'column1' => 'value 1',
            'column2' => $value_2
        );

        $where_array = array(
            'column 3' => 'value 3'
        );

    $wpdb->update('table_name', $update_array, $where_array);
?>

A quick idea for the permissioning, have you made the "update" page private and/or hidden?