Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I submit search data to custom page searchi.php

<?php
    //
    $search_variables = $_GET['s']. '+' .$_GET['cat'];

    //This sends http post to url without curl
    header("Status: 301 Moved Permanently");
    header("Location:http://localhost/wordpress/?s=$search_variables");
    exit;

?>

I know wp_query sanitize variables for me, so should not worry about it. But its better to ask than be sorry, is there any way this would compromise security?

I noticed echoing variable $search_variables with <div></div> inserted through search form works, so should I do something about it?

share|improve this question

1 Answer 1

No. WordPress sanitizes the search query.

To use the sanitized search query, use the_search_query() to echo, or get_search_query() to return, the search query.

Edit

Based on your edit:

  • Don't use $_GET['s']. Use get_search_query().
  • Don't use $_GET['cat']. Use get_the_category().
  • All $_GET and $_POST data should be assumed to be inherently unsafe, and should be sanitized/validated accordingly.
share|improve this answer
    
But, searchi.php is not part of wordpress, and 'cat' is not a real category, I'm using relevanssi plugin to match complicated strings. So I need this extra outside page that just puts two input content into 1 and submit it back to wp search. Honestly I don't see problem with my current implementation, I do use GET but the contents of GET goes to original wp search query anyways, so where is the risk? More detail would be appreciated on the matter. –  Sandro Dzneladze Aug 30 '12 at 19:39
    
"I do use GET but the contents of GET goes to original wp search query anyways" - I'm not sure how to answer any more clearly. If you want assumed safe, use get_search_query(); if you use $_GET data, you should assume that it is unsafe and treat it accordingly. –  Chip Bennett Aug 30 '12 at 19:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.