WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?

list($email_id, $user_id, $url, $anchor) = explode(';', base64_decode($_GET['r']), 4);
        'email_id' => $email_id,
        'user_id' => $user_id,
        'url' => $url,
        'anchor' => $anchor
share|improve this question

wpdb::_insert_replace_helper() will escape the data:

return $this->query( $this->prepare( $sql, $data ) );

But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.

share|improve this answer
Plus, the base64 code is retrieved from a $_GET query far! Do not use this code! – shea Jan 10 '13 at 8:28
@bungeshea There is nothing wrong per se with base 64, it is just hard to read. – toscho Jan 10 '13 at 10:46
I know that base64 in itself is okay, but the retrieving-from-$_GET part bothered me. – shea Jan 10 '13 at 10:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.