Is it safe to use admin-ajax.php in the frontend?

Question

I am using Filter Custom Fields & Taxonomies Light. I found out it is using admin-ajax.php in the frontend for the AJAX search even not logged in.

See:

https://plugins.svn.wordpress.org/filter-custom-fields-taxonomies-light/trunk/profi-search-filter.php

add_action( 'wp_head', 'sf_head', 1 );
function sf_head(){
    $settings = get_option( 'search-filter-settings' );
    if( !isset( $settings['style'] ) || $settings['style'] == '' )
        wp_register_style( 'sf-style', SF_URL . 'res/style.css' );
    else
        wp_register_style( 'sf-style', SF_URL . 'res/' . $settings['style'] . '.css');
    wp_enqueue_style( 'sf-style' ); 


    wp_enqueue_script('jquery');
    wp_enqueue_script('jquery-ui-slider');
    wp_register_script( 'sf-script', SF_URL . 'res/sf.js' );
    wp_enqueue_script( 'sf-script' );

    ?>
    <script>var sf_ajax_root = '<?php echo admin_url('admin-ajax.php'); ?>'</script>
    <?php
}

Is that a common way of doing AJAX in Wordpress or a security hole?

Answer 1

See documentation here but don't miss the note 2 and the following points :

• AJAX on the front-end is more complicated, ajaxurl is not defined so you have to call it with wp_localize_script().
• you have to use wp_ajax_nopriv_{action} for non logged in users
• there could be security issue !!!

About the third point :

Be careful because you give access to non logged in users to some data and functions. So you need to ask yourself about what you want to do. It could seem a little bit too much but to me when using AJAX on the front-end of WP you should make $_GET things, only for reading, for example infinite scroll ans stuffs like that, not delete, create and update actions.