Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:

add_filter('name_save_pre', 'save_name');
function save_name($name_to_ignore) {
         global $post, $meta_box, $wpdb;

     $this_post_id = $post->ID;
         // verify nonce -- checks that the user has access
     if ( !isset($_POST['wp_nonce']) || !wp_verify_nonce( $_POST['wp_nonce'], basename(__FILE__) )) {
        return $post_id;
    }
         if ($_POST['post_type'] == 'mytype') :
          $name1 = $_POST['term1'];
          $name2 = $_POST['term2'];
          $name3 = $_POST['custom_field_1'];
          $name4 = $_POST['custom_field_2'];
          $my_post_name = $name1."-".$name2."-".$name3."-".$name4."-".$this_post_id;
        endif;
        return $my_post_name;
}

I just want to is it secure to save the data this way. Cause I read somewhere else (which is I forgot where), said that using $_POST['Custom_field']; is very easy to get hacked. Is it true?

share|improve this question

1 Answer 1

Validate input values and sanitize outputting data. Take a read good article about Data Sanitization and Validation With WordPress, it will make you understanding these principles better.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.