Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am using loops as means of displaying personal meta and customer information on the frontend.

For example, I have a page which displays a user's 'profile' information to edit. Their profile is custom post type that was created when the registered. The loop for the edit screen finds the one cpt based on the current user id, populates the form fields, and after submission updates the post. Is this secure?

If not what some better ways to handle this type of action?

*--Edited to include example code

Here is a sample loop. This is pulling in a vendor's items they sell. The GF hooks pre-populate the form in the middle with the meta from the product, after submission the post is updated.

<?php
$q = new WP_Query( array( 'author' => $current_user->ID, 'post_type' => 'product' ) );
  if ( $q->have_posts() ) {
      while ( $q->have_posts() ) {
         $q->the_post( ); ?>

         <div id="<?php the_id(); ?>" class="tab_content_trip" style="display:none;">
               <?php echo do_shortcode('[gravityform id="7" title="false" description="false"  ajax="true"]'); ?>
         </div>

        <?php }
   wp_reset_postdata();
} ?>

So my question is if it is possible for someone to somehow hijack a loop like this and edit other users posts in some way? (of course not including if they somehow steal their password, or something of that nature)

Essentially, I am seeking some insight on best practice for securely filtering user information to be displayed on the frontend

share|improve this question
2  
»It is secure to lock the door when I leave my home?« ... »YesNo.« ... as it depends on the lock, the door... and if you have left a window wide open. How should we tell without seeing the code? –  kaiser Oct 17 '12 at 2:40
    
Hi Kyle this will probably be closed unless you have a specific question or would like to clear up what your trying to ask. –  Wyck Oct 17 '12 at 3:03
    
Added edits to give more detail to my question –  Kyle Oct 17 '12 at 17:55

1 Answer 1

up vote 0 down vote accepted

This loop looks pretty sure to me. You aren't exposing any raw SQL anywhere, so injection attacks shouldn't happen.

share|improve this answer
    
Thanks for the reply Eric. Okay great, I will look into that area. This is a topic I have not been able to find discussed much, so I appreciate the input. –  Kyle Oct 17 '12 at 22:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.