0
votes
1answer
41 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
0answers
30 views

How to escape shortcode content? Do I even need to escape or validate?

I've written a small shortcode that wraps it's content into a HTML element, like so: [my_shortcode]The sun is shining today.[/my_shortcode] In my shortcode function, I basically return the string ...
3
votes
1answer
408 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
0
votes
1answer
113 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
3
votes
1answer
726 views

Masking logout URL

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
-1
votes
1answer
140 views

Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?

I was thinking of adding the following lines of code to my functions.php file: /** * Change the default list of allowed html tags */ add_action('init', 'edittag', 10); function edittag() { ...
1
vote
1answer
60 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?