0

I am using Filter Custom Fields & Taxonomies Light. I found out it is using admin-ajax.php in the frontend for the AJAX search even not logged in.

See:

https://plugins.svn.wordpress.org/filter-custom-fields-taxonomies-light/trunk/profi-search-filter.php

add_action( 'wp_head', 'sf_head', 1 );
function sf_head(){
    $settings = get_option( 'search-filter-settings' );
    if( !isset( $settings['style'] ) || $settings['style'] == '' )
        wp_register_style( 'sf-style', SF_URL . 'res/style.css' );
    else
        wp_register_style( 'sf-style', SF_URL . 'res/' . $settings['style'] . '.css');
    wp_enqueue_style( 'sf-style' ); 


    wp_enqueue_script('jquery');
    wp_enqueue_script('jquery-ui-slider');
    wp_register_script( 'sf-script', SF_URL . 'res/sf.js' );
    wp_enqueue_script( 'sf-script' );

    ?>
    <script>var sf_ajax_root = '<?php echo admin_url('admin-ajax.php'); ?>'</script>
    <?php
}

Is that a common way of doing AJAX in Wordpress or a security hole?

1

1 Answer 1

2

See documentation here but don't miss the note 2 and the following points :

  • AJAX on the front-end is more complicated, ajaxurl is not defined so you have to call it with wp_localize_script().
  • you have to use wp_ajax_nopriv_{action} for non logged in users
  • there could be security issue !!!

About the third point :

Be careful because you give access to non logged in users to some data and functions. So you need to ask yourself about what you want to do. It could seem a little bit too much but to me when using AJAX on the front-end of WP you should make $_GET things, only for reading, for example infinite scroll ans stuffs like that, not delete, create and update actions.

2
  • I agree for the $_GET in fact when I use $_GET in ajax I use it as (int)filter_input(INPUT_GET, 'post_id'); where (int) is sometimes (string).
    – knif3r
    Jul 17, 2016 at 15:50
  • @JMau What if you have for example audio player and you want to count plays, you have to use ajax on frontend to tell backend to update and retrieve play count in wpdb. Is there alternative to this?
    – Toniq
    Dec 21, 2017 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.