I'm trying to understand how to protect my custom form from possible attacks.

I send a data via a form, let's say userdata, then I read it:

$userdata = $_POST['userdata']

I put it into an array to use wpdb->update:

$updatevalues = array( $userdata );

And I've my where array too:

$where_data = array( $mydata ); //mydata is declared elsewhere

I connect to the database:

$mydb = new wpdb('root', 'password', 'database', 'localhost');

And I update the table:

$uptable = $mydb ->update('table',$updatevalues,$where_data);

Is this enough or should I do something to protect? wpdb->update is sufficient?


1 Answer 1


Yes, $wpdb->update is sufficient protection. You should not escape or prepare the data.

From the documentation of wpdb:

data (array) Data to update (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped). This means that if you are using GET or POST data you may need to use stripslashes() to avoid slashes ending up in the database.

As a side note, you can help wordpress better understand the content to prepare for the database by including format and where_format in your update call.

$uptable = $mydb->update(
    $data_format, // '%d' for numbers, '%s' for strings, can be an array
    $where_format // Same here

Update: In reply to your comment:

It depends on the data you are saving and its purpose.

Your next step after SQL injection is to prevent XSS attacks. This is where a user is able to enter malicious Javascript into your text field, and the database saves it and then your site happens to display it to other users.

While this can be prevented by using esc_html() when displaying the content from the database, it's better not to have that stuff in the database in the first place!

As for the code to do this, it would look like this:

$user_value = stripslashes($_POST['user_value']);
$user_value = sanitize_text_field($user_value);
$user_data = array('table_column' => $user_value);
$user_format = array('%s'); // Means $user_value is a string
$where_data = array('id' => 5); // example
$where_format = array('%d'); // Means 'id' is a number

And if you only want that data to be alpha numeric, you could wrap the code after stripslashes with if(ctype_alnum($user_value)). Ultimately you only want the exact data you need and nothing more.

Hope that helps!

  • Hello @true: first of all thanks for your reply. I've been suggested to use also "$userdata = sanitize_text_field($_POST['userdata'])". Is this fine? Where should I use the stripslashes function? I wasn't sure about the fact that wpdb->update is sufficient because of the difference here from insert and update description: codex.wordpress.org/Data_Validation#Database Jan 29, 2015 at 12:26
  • No problem! :) Updated my answer with a response.
    – true
    Jan 29, 2015 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.