Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Short version:

  • Step 1/ i am using contact form 7 to collect some user data and i insert the data into a custom database table.
  • Step 2/ only the custom table needs to be altered/updated. In fact at the moment only one column needs to be updated by hand

The client wants a very simple UI to update the data. The client doesn't want/need full access to WP-admin. So i was thinking of creating a password protected wp-page with the UI for the one db table. Just spitting out all data and let the column be editable.

What are your thoughts??

regards

share|improve this question

2 Answers 2

-1 for the password protected page

  1. What happens if the client forgets the password, or forgets the URL of the page? he will need an access to the admin to change it, so you don't save anything here

  2. What is the chance the password will not be 123456, the client's name, or the name of the company? there are tools and tutorial to harden the access to the admin (limiting it to specific IPs for example). Will you implement any of them for that page?

Of course, if the data is not very important then it doesn't really matter.

share|improve this answer
    
i know, i know stupid me ;P. I will let phpmyadmin generate a password and use that one. The page is just for 1 client. Thinking about the limit ip access, will –  alex Feb 27 '13 at 12:41

I'll answer this from a security perspective, please add additional detail to the question if you are more interested in the user interaction/UI/etc. side of things.

You could argue that a password protected page offers far less security when compared to a default WordPress user, therefore you might want to setup up one or more very basic user accounts (e.g. user level contributor) and redirect the user to your editing page when they log in. That will probably be easier to manage, than using a password protected page. But I guess that would also greatly depend on the number of clients needing to access the page and the tasks they need to perform once logged in.

Also, as long as you are correctly escaping your database operations and the data included there you should be fine. This should probably suffice to update the database table securely with data received in a POST request (though you'd likely want to do some manual validation/cleaning first):

global $wpdb;
$query = $wpdb->prepare( "UPDATE $wpdb->wpse_88623_custom_table SET field_1 = %s, field_2 = %s, field_3 = %d WHERE id = %d", $_POST['field_1'], $_POST['field_2'], intval($_POST['field_3']), intval($_POST['id']) );
$wpdb->query( $query );
share|improve this answer
    
tx for your explanation. You certainly have a point, i am going to look into the default WP user +redirect to the page. Also thanks for the prepare( –  alex Feb 27 '13 at 12:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.