I have an element in my front end that looks like this:

<div class="infinite-scroll" data-query-args='{"post_type":"post","tax_query":[{"taxonomy":"category","field":"term_id","terms":62}]}'></div>

It's a container for triggering an infinite scroll that I made. Since I want it to work with multiple queries and multiple front end situations, the simplest way to make it work was to put the JSON encoded WP query directly in the element and pass it back to the server when loading more posts.

This feels like a security issue to me, so what's the right way to make sure this can't be exploited? I'm not saving any of that string in the DB so I don't see how I can make sure it's secure.

If it's an all around bad idea then I can restructure it, but I'd rather not since the queries can get a little more complex with tags, multiple categories, search terms, etc. The only proper alternative I can think of is a data- tag for each item in the query (data-post-type, data-tax-query, etc) but it's a lot more work.


  • This is a dangerous idea, assuming security is top notch, this could bring down your site through performance alone. What's to prevent somebody from crafting an expensive meta query and spamming your server?
    – Tom J Nowell
    Sep 13, 2016 at 19:47
  • Yeah I thought about that a couple minutes after posting this question and it convinced me to restructure but I left the question open because I'm still curious about an answer. Thanks Sep 13, 2016 at 19:50
  • @Brian are the query args only set by the back-end, or can user interaction modify them on the front-end prior to being dispatched to the server for more results?
    – bosco
    Sep 13, 2016 at 21:18

1 Answer 1


The only way to do this would be to whitelist the allowed arguments, being very careful to limit them so as not to introduce an DOS attack vector.

Having said that, this is not how most infinite scroll implementations are built, and you may have better results relying on the WP API rest api instead for those kinds of requests

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.