I'm doing a small plugin that is doing this:

wp_redirect( 'http://old.example.com'.$Path );

I think that's safe, even if there's user input (request uri) in the function, anyway it should be equivalent to directly typing old.example.com/malicious_url, right?

  • 2
    not sure what is the question here. If it is "can I trust user input" he answer is always "no". but if it is "Can I feed any garbage to wp_redirect without bringing the end of life as we know it" the answer is most probably yes. As for the other part... there is nothing that prevent that REQUEST_URI to be different than what the user actually "typed", so it depends on the exact setting – Mark Kaplun Aug 2 '16 at 10:56

You can never trust user input. Always prepare a value that you want use in your own code. Example:


if ( $path )
    $url         = 'http://old.example.com' . $path;
    $url_escaped = esc_url( $url );
    $status      = 301;
    $message     = "Moved to <a href='$url_escaped'>$url_escaped</a>.";

    wp_redirect( 'http://old.example.com'. $path, $status );
    wp_die( $message, 'Moved', $status );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.