WordPress SQL search: How to handle SQL Injection during the default search?
Sitename.com/?q=test OR 1=1 --
shows all the article.
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.Sign up to join this community
The default public search query variable is
s but not
So when you use
q, on a vanilla WP install, no posts filtering is done, as expected.
You don't have to take care of possible SQL injections, for the default search query, as it's taken care of by the core.
Here's an example when we run the
test OR 1=1, the
WHERE part of the generated SQL search query is:
AND ( ( (wp_posts.post_title LIKE '%test%') OR (wp_posts.post_excerpt LIKE '%test%') OR (wp_posts.post_content LIKE '%test%') ) AND ( (wp_posts.post_title LIKE '%1=1%') OR (wp_posts.post_excerpt LIKE '%1=1%') OR (wp_posts.post_content LIKE '%1=1%') ) )
For this case we don't see the query search string breaking the SQL query.
If on the other hand you're adding your own search query, e.g. by modifying the main
WP_Query by hand, then you need to watch out for possible SQL injections.
The question is sparse on details, but I'm assuming that's not the case here.