Tag Info

Hot answers tagged

3

What you're doing at the moment is okay, but there are far far better ways to do it. The problem of man in the middle attacks here is that to insert yourself between wordpress.org and a server at a data centre is no easy task, so this scenario is very unlikely. However If you abandon the built in updater and instead rely on git repositories to pull down ...


1

Your update is as secure as a weakest point in your update chain. Since upgrade are done via HTTPS since 3.7 a MITM attack against wordpress.org will be so hard it is not worth your time to even consider protecting yourself against it as anyone with the resources for that will get you in one way or another. The more problematic points are actually the ...


1

What you did wrong here was to prepare those items in the first place. You only run "data" variables through prepare(). You don't run table names, or sort directions, or limits through it. These are part of the SQL command itself, they are not data that refers to information which is stored in a column in the database. Your SELECT query has no data ...


1

No, it is not. Use esc_html__( 'string', 'text_domain' ) instead (two underscores). Translated strings are unknown input. Unknown input is per default malicious. You don’t know where the language file comes from. It doesn’t even have to be the one you provided, because the path can be filtered. Even if it is your file: do you have control over the whole ...



Only top voted, non community-wiki answers of a minimum length are eligible