Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?

list($email_id, $user_id, $url, $anchor) = explode(';', base64_decode($_GET['r']), 4);
$wpdb->insert(NEWSLETTER_STATS_TABLE,
    array(
        'email_id' => $email_id,
        'user_id' => $user_id,
        'url' => $url,
        'anchor' => $anchor
    )
);
share|improve this question
add comment

1 Answer 1

wpdb::_insert_replace_helper() will escape the data:

return $this->query( $this->prepare( $sql, $data ) );

But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.

share|improve this answer
    
Plus, the base64 code is retrieved from a $_GET query far! Do not use this code! –  bungeshea Jan 10 '13 at 8:28
    
@bungeshea There is nothing wrong per se with base 64, it is just hard to read. –  toscho Jan 10 '13 at 10:46
    
I know that base64 in itself is okay, but the retrieving-from-$_GET part bothered me. –  bungeshea Jan 10 '13 at 10:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.