I need to make sure I'm not opening up a security hole in my site. I have a Custom Post Type called "Communities" and a custom post type called "Floor Plans" and need to add a parameter to the URL on Single Floorplan posts.
My goal is that when a Floorplan post object is selected from a Communities Single post, it appends the name of the community (i.e. single community post title) to the URL for use on the following page. So, enabling query vars:
<?php
//* Enable queryvars (functions.php)
add_filter('query_vars', 'parameter_queryvars' );
function parameter_queryvars( $qvars )
{
$qvars[] = "community";
return $qvars;
}
I have a template part called "dynamic-floor-plans" that lives in a loop at the bottom of Single Communities posts. I'm grabbing the single_post_title of the current communities page, and passing that to the URL so that it's available using $_GET
The reason we opted for this method is that the "Floor Plans" post type has a canonical/default version that has the same properties as its Community-specific counterparts. In order to avoid a post relationship situation (which would give the user flat out wrong data in some cases) the community versions just have to be able to use these query strings in very specific instances.
<?php
//* dynamic-floor-plans template part (placed in loop on communities page)
global $post;
$string = strtolower(single_post_title( null, false ));
$slug = str_replace(' ','-',$string);
?>
<div class="card-button">
<a class="small expanded secondary button"
href="<?php echo get_the_permalink() . '?community=' . $slug ?>">View Floorplan</a>
</div>
Now, this totally is working. I'm able to grab that community variable on the subsequently-selected floorplan single page using $_GET and things seem to be working nicely on the front end:
<?php
//* Single Floorplans Template
$community = $_GET["community"];
?>
<h1 class="entry-title"><?php echo $title ?></h1>
<h4>
<?php if ($community) { ?>
At <?php echo $community; } ?>
</h4>
...
I just can't help but feel that this isn't kosher, or that there's a more secure way to do this.
Am I open to exploitation? I can include the function for the loop itself as well, but figure this code will be sufficient to get started in evaluation.