0

So I'm working on a small plugin, and this plugin allows users to save data to my db. This data is mostly plain text but 3 fields are will have tags inside them.

1 field can be used to save all kind of code(js/php/html....) into my db, and 2 fields can only accept JS code.

My question how should I save this kind of data into the DB to prevent injections and such.

I am still new to the whole validation stuff so any tips and help would be nice (dont put the links to the wordpress docs in the comments below, I already read those)

My code until now

  $wpdb->insert($table,
      array(
          'field-no-tags'       => sanitize_text_field($_POST['field-no-tags']),
          'field-have-all-tags' => $_POST['field-have-all-tags'],
          'field-have-js-tags'  => $_POST['field-have-js-tags']
      )
      ,array(
          's%',
          's%',
      )
  );


  <form>

      <label>No code allowed</label>

      <textarea name="field-no-tags"></textarea>


      <label>All code allowed</label>

      <textarea name="field-have-all-tags"></textarea>


      <label>Only JS allowed</label>

      <textarea name="field-have-js-tags"></textarea>

      <button type="submit">Save</button>

  </form>
Improve this question
3
  • If I understand your question correctly, you want all values to be text contents, but some fields should allow a limited set of HTML tags (no tags, all tags, <script> tags), right? strip_tags is obviously insufficient. Are you sure you want to allow PHP code? One of the problems you'll encounter is that nobody uses CDATA in script tags, and that's why simple XML processing is not enough to filter <script> tags. Allowing code in text is quite unusual, why do you want to do it this way?
    – Tobias
    Commented Sep 8, 2014 at 10:33
  • This plugin is the wordpress version of a Javascript plugin, one that has callback functions(hooks), which allows a user to add his/her own javascript. The other field is a field where some HTML is used to build parts for the javascript plugin(this part is very flexible and therfor it cant be build by the plugin it self).
    – user759235
    Commented Sep 8, 2014 at 10:41
  • Don't you think it could be sufficient to have one field which allows arbitrary HTML code and one which accepts arbitrary JS code? Everybody who can set JS code to execute on a page has full control over the page, so it might be unnecessary to try to control the HTML content.
    – Tobias
    Commented Sep 8, 2014 at 10:43

1 Answer 1

Reset to default
1

there are two possible injection vectors, server side and client side

  • server side - Just don't write your own SQL and use the more high level DB access APIs, in your case probably update_option. If you must to access the DB at lower level make sure the API use wpdb::prepare while generating the SQL, which is true for insert but not true for query which requires the use of prepare if you use placeholders in the query.

  • client side - You should never let anyone that is not the admin of the site to admin the plugin. This means it is not suitable to use in a network unless you will restrict the access there to only the super admin. Any other configuration will enable the site's users to do XSS attacks against other users of the site.

Improve this answer
2
  • All of the data is stored in a custom database table, so I cant use the update_option function for this. I do have build in a user manager, which allows the admin to select the users which can use the form.
    – user759235
    Commented Sep 8, 2014 at 11:19
  • answer editted.
    – Mark Kaplun
    Commented Sep 8, 2014 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.