Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am trying to clean up my wordpress theme and I want to know what triggers the following questions on my blog homepage.

First - do I need this on my homepage?:

SELECT user_id, meta_key, meta_value FROM wp_usermeta WHERE user_id IN (1)

require('wp-blog-header.php'), require_once('wp-includes/template-loader.php'), include('/themes/baracuda/index.php'), setup_postdata, get_userdata, get_user_by, WP_User->init, WP_User->for_blog, WP_User->_init_caps, get_user_meta, get_metadata, update_meta_cache

Second:

SELECT * FROM wp_users WHERE ID = '1'
share|improve this question
1  
Can you also copy the part of your html/php code just so that I can understand where exactly these snippets are used. –  Kuldeep Daftary Sep 18 '12 at 21:50
    
Do these queries fire when you are not logged in? If you are logged in WordPress makes a look-up for the current user – hence the user queries. –  toscho Sep 18 '12 at 22:35

1 Answer 1

up vote 0 down vote accepted

Are the queries themselves displayed or are the results displayed? If the results of those queries are being output onto your homepage it's a potential security vulnerability.

The query returns user data including username and password hash for user ID 1 of the wp_users table, which is the administrator user that Wordpress creates when first installing.

I recommend changing the administrator's password and removing the code from the homepage, and checking other template files for similar code.

Also its generally a bad practice to run SQL queries in theme files, as there are built-in functions in Wordpress for accessing user data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.