New answers tagged security
Just removed the admin user from buddypress 1.9.2 here's how I did it : my admin user id 2 at the file : buddypress\bp-members\bp-members-template.php look for line 292 'exclude' => false, and change false to ur user id my case 2 : // type: active ( default ) | random | newest | popular | online | alphabetical $defaults = array( 'type' ...
Viewing passwords is not possible, because they are not stored anywhere. WordPress stores just the hash of the password, not the password itself. When a user sends her password to authenticate herself, WordPress creates a hash of the sent password and compares that to the stored hash. You should not try to store the passwords as plain text anywhere. That ...
I won't repeat any of the good advice in Squish's answer. You should also read this article on Wordpress security. I'm just going to cover the specifics of what I learned from my episode. My attack is a kind of black hat SEO known as "hideMeYa": http://siteolytics.com/black-hat-seo-technique-demystified/ Basically, the attacker slips a bunch of hidden ...
In general, the best place to look is in your theme folders, specifically the main theme and in the index.php file. Then the footer and header files. Also, check your modified dates and start with the most recently modified. Especially if there are several that were all modified around the same date/time. I've seen, and had to fix, this problem several ...
Nonces are used to verify that a request is allowed from the sender. For public data, all GET requests are allowed, if they match existing public content. So no, do not use a nonce for that. You have nothing to do if the nonce validation fails. That’s always a good indicator for unnecessary information.
The plugin Secure XML-RPC seems to address the issue of sending sensitive info over the wire. Plugin description: Rather than sending usernames and passwords in plain text with every request, we're going to use a set of public/secret keys to hash data and authenticate instead.
YES. You always escape output that originally comes from user submitted data. To be safe, you always escape variable output, period.
Yes, You should but not always. Like whenever you are not sure that a user might enter some html stuff like a hyperlink and you don't want that, then you should escape it. As codex says : Always use when escaping HTML attributes. Codex: esc_attr Wordpress Codex
Yes you should escape. the DB is supposed to hold the raw value therefor you should assume it needs to be escaped. Do you need to escape every little thing like in your example? I don't, but maybe you should not do as I do ;) Some things are safer to assume that the user will not input some random keystrokes, but there is always that one user that will ...
Top 50 recent answers are included