Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?

  • 2
    Best practices exist for a reason. You really don't want to have to go back through and deal with resanitizing everything if down the road you decide to change something. And really, what extra effort is it? A few characters? Just do it. Dec 24 '14 at 1:42

You should always sanitize all inputs regardless of who or where they are coming from. Not only is it good practice (which helps ensure that you don't accidentally get comfortable skipping it and miss it elsewhere), but it ensures that that particular feature is secure in the future. For example, you may wish to expand upon your feature in the future or have editors join you. If you forget about fixing your security lapse, you could be in for some big trouble.

Bottom line: Sanitize all the things. It helps and never hurts. Also never trust your users, even yourself!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.