4

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save.

But after this filter:

Thomas' OR SELECT * FROM wp_user

Is still save into DATABASE as full text. And ' char is not escaped as ' or \'.

I use $wpdb->query("INSERT INTO A (a,b,c) VALUES ('{$a}', '{$b}', '{$c}')"); So $a has to be a valid value here, which can be inserted into db. I have reasons not to use insert(), prepare() etc. specific functions, so I need to be sure that $a is VALID and SECURE. How to ensure that for text data like last name, or comment.

So is this brokes the security?

  • Are you saving these through raw SQL or update_*() functions? If it's the former then you'll need to also use prepare() - other than that, sanitize_text_field() is a normal sanitization function which is fine in most cases. – Howdy_McGee May 16 '16 at 21:21
  • I don't wan't to use prepare(). I use $wpdb->query("INSERT INTO ... $x"); . I need a solution without prepare. – KestutisIT May 16 '16 at 21:32
  • valid what? secure for what purpose? – Milo May 16 '16 at 22:03
  • Updated the message. Valid text so that it could be inserted into db, and won't break db on insert process (i.e. will not drop other table or do something bad) – KestutisIT May 16 '16 at 22:30
  • 2
    You want to be secure but you want to reinvent security oriented API. This doesn't make much sense. – Mark Kaplun May 17 '16 at 1:35
5

You can use wpdb insert function. It's better in every way.

It can care about data's escapeing itself and it's shorter.

You can use your own query anyway but I would recommended this article for reading https://codex.wordpress.org/Data_Validation#Database

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.