1

I've been reading the codex at this page: http://codex.wordpress.org/Function_Reference/stripslashes_deep

The code i wrote before reading that page is this:

$data   = array(
    'col1' => $v['float'],
    'col2' => stripslashes($v['string'])
);
$format = array( '%f', '%s' );
$wpdb->insert( 'table', $data, $format );

Basically i manually pass stripslashed values in the $data array. Now, is this code correct and secure or shall i perform a $_REQUEST = array_map( 'stripslashes_deep', $_REQUEST );? Is there any important difference or is it the same?

1 Answer 1

2

If you check out the source for the $wpdb->insert( $table, $data, $format) method you will find this comment:

Data to insert (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped).

so you shouldn't need to do the SQL escape yourself on the data.

As far as I understand the process, the data inserted into the $wpdb->insert() method, goes through:

  • the $wpdb->prepare() method,
  • which uses $wpdb->escape_by_ref(),
  • which uses $wpdb->_real_escape(), for non floating values: ! is_float( $string ),
  • that uses the PHP wrapper mysql_real_escape_string() or mysqli_real_escape_string() for WP 3.9+ with PHP 5.5+.

From the PHP docs on the mysql_real_escape_string() function:

Escapes special characters in the unescaped_string, taking into account the current character set of the connection so that it is safe to place it in a mysql_query(). If binary data is to be inserted, this function must be used. mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a. This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.

But as stated in the Codex page you refer to, in older versions of PHP the addslashes can be automatically applied to the $_POST, $_GET and $_REQUEST globals. The Magic Quotes feature is deprecated in PHP 5.3 and removed in 5.4.

6
  • 1
    so, at the end, what should i do? what's the correct and safe way to pass a string to wpdb->insert? if i don't stripslash the string, i don't think i will be able to preserve an eventual new line in a textarea...right?
    – Mariano
    Mar 29, 2014 at 12:08
  • This should take care of SQL injections, but you still have to do the validation/sanitazion. I think new lines will be preserved. If you want to allow HTML input, consider using wp_kses() to strip out evil scripts.
    – birgire
    Mar 29, 2014 at 12:36
  • no html, only \n new lines...so i don't have to worry about evil scripts...
    – Mariano
    Mar 29, 2014 at 12:41
  • I'm not sure you want to strip out all HTML or just encode it. If you want to strip HTML and only allow alphanumerics and white spaces (including new lines): echo preg_replace( '/[^a-zA-Z0-9\s]/i', '', wp_strip_all_tags( $text, FALSE ) ); but this might be too restrict for you ? There also exsits the WordPress functions esc_html() to escape HTML blocks and esc_textarea() to escape the textarea content.
    – birgire
    Mar 29, 2014 at 14:12
  • To strip out any % encoded octets: $text = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $text ); I'm not sure this exists as a special function, but it's included in some WordPress functions.
    – birgire
    Mar 29, 2014 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.