I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is.

What security measures should i take to make sure i leave security holes?

the comments are submitted via ajax and so in the php file reciveing the data i use $_POST to collect data. How would you treat those inputs so make it bullet proof as possible and

I know how to secure forms so i am basicly asking:
Does wp_insert_comment run (After submission) trough any other built in wordpress functions?

1 Answer 1


wp_insert_comment() is low level function, it only saves passed data without concern for what it contains.

If you are looking to replicate sanitizing WP does on comment data (totally good idea :) you are probably looking for higher level wp_new_comment().

  • Hi @Rarst - many many thanks. i didnt even knew this functions exists... someone should edit wp codex to link to it ;) (too humble to do that). Thanks for your help.
    – Sagive
    Sep 14, 2013 at 14:07
  • Follow up small question. Do you think i can remove wp-comments-post.php or change its name if i am using a custom function like this? - tell me if its off topic - aplogize in advance - seems pointless to cr8 a new question for this.
    – Sagive
    Sep 14, 2013 at 21:30
  • @SagiveSEO modify core files is considered bad practice. You might ask new question how to block comments only submitted "normal" way, but it might make sense to simply block requests to file on web server level.
    – Rarst
    Sep 15, 2013 at 8:56
  • yee, kinda tought so ;), thanks again for your help @Rarst
    – Sagive
    Sep 15, 2013 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.