Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am trying to write a short plugin that will filter html characters from the search form. In the event someone enters in <script>alert('some infectious js!');</script> into the search form i want to remove the possibility of this command to be entered into the search form.

I tried this:

function SearchFilter( $query ) {
     if ( is_search() ) {
          $query = strip_tags($query);
          return;
     }
 }
 add_action ('pre_get_posts', 'SearchFilter');

When I go to test it, i enter <script>alert('some infectious js!');</script> above into the search field and all I get is a blank white page in wordpress. The search still works but anytime i type in script it breaks the box. This seems odd that wordpress doesn't handle this by default OR am i totally wrong on this?

Thanks in advance.

share|improve this question
add comment

1 Answer

WP does handle that case already, the script will never be executed, because the function the_search_query() will return its output escaped.

Escaping this prior to the actual search would break searching in code. If you blog about script injections your visitors should be able to search for that.

Update

Here is one of my older plugins. It enables searching in escaped code and breaks the search for unescaped <, & or >. Unfortunately, it has some side effects when it is used together with search plugins like Relevanssi or Search Unleashed.

<?php # -*- coding: utf-8 -*-
/**
 * Plugin Name: T5 Search escaped characters
 * Description: Enable to search for escaped &lt;, &gt; and &amp;.
 * Plugin URI:
 * Version:     2012.08.25
 * Author:      Thomas Scholz
 * Author URI:  http://toscho.de
 * License:     MIT
 * License URI: http://www.opensource.org/licenses/mit-license.php
 */

add_filter( 'posts_search', 't5_search_escaped_characters', 10, 2 );

function t5_search_escaped_characters( $search, $obj = NULL )
{
    if ( $obj->is_search and empty ( $search ) and is_main_query() )
    {
        remove_filter( current_filter(), __FUNCTION__ );
        return ' AND 1 = 2 ';
    }
    $s   = $obj->query_vars['s'];
    // Double-encoding FALSE in case another plugin did that already.
    $esc = htmlspecialchars( $s, ENT_NOQUOTES, 'utf-8', FALSE );
    return str_replace( "%$s%", "%$esc%", $search ) . ' ';
}

Might be a start if you want to touch the search string early enough.

share|improve this answer
    
thanks for the reply. We had a security scan from a 3rd party source done on our website and the results indicate that the scrip injection is actually reaching the database. Perhaps this is also a false positive. I don't see the js execute, but it does return a page with all of our blog posts listed on it, which I thought was odd. I'd rather it be completely denied and show a 404 page or an error page. Anyway to get it to do that in this case? –  Robbiegod Oct 14 '12 at 14:17
    
oh yeah, also there is no reason why someone on my website would want or need to search for script injections so i would rather just prevent those words altogether. If Wordpress already has this type of defense then its probably a false positive we are getting from the results of our security scan. –  Robbiegod Oct 14 '12 at 18:09
    
interesting...I will take a look at that...that might do the trick. –  Robbiegod Oct 15 '12 at 3:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.