Do I need to prepare strings against MySQL Injection when inserting into the database using a WordPress comments function such as this:

$data = array(
    'comment_post_ID' => $post_id,
    'comment_author' => $comment_author,
    'comment_author_email' => $comment_email,
    'comment_content' => $comment_body,
    'comment_type' => '',
    'comment_parent' => 0,
    'user_id' => 1,
    'comment_author_IP' => '',
    'comment_agent' => 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)',
    'comment_date' => $time,
    'comment_approved' => 1,


Update: From this page it seams as though it handles all of this, but doesn't strip HTML/PHP tags; is this in itself worth stripping on a purely security basis?


Higher-level API functions like this in WP typically do the $wpdb->prepare() call to protect against MySQL injections.

As for content by default comments do allow HTML, however it isn't just anything. If you examine default-filters.php there are quite a few sanitizing functions hooked to processing comment data, including wp_kses_post() which limits HTML to white listed subset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.