How to securely provide a $_POST var in WP_Query with PHP 7?

Question

In PHP 5.5 you had the function

mysql_real_escape_string()

and I always did

htmlspecialchars(mysql_real_escape_string($_POST['...]));

to secure against SQL-Injection.

With PHP 7 mysql_real_escape_string() is gone. An alternative is

mysqli_real_escape_string()

but that function needs a link to the mysqli object. When using WordPress to perform a query like this:

$query_args = array( 's' => $_POST['search'] ); $query = new WP_Query( $query_args );

I can't provide a mysqli object. So Do I have to leave all the security stuff to WordPress? Is it enough to do:

$query_args = array( 's' => htmlspecialchars( $_POST['search'] ) ); $query = new WP_Query( $query_args );

?

Answer 1

Maybe you could try this, to sanitize the whole $_POST array

$_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

Or to sanitize just a field, you could use the native WP function

$sanitized = sanitize_text_field ( $_POST['key'] );