0

WordPress SQL search: How to handle SQL Injection during the default search?

Example : Sitename.com/?q=test OR 1=1 --

i.e.,

q=test%20or%201=1%20--

shows all the article.

1

The default public search query variable is s but not q.

So when you use q, on a vanilla WP install, no posts filtering is done, as expected.

You don't have to take care of possible SQL injections, for the default search query, as it's taken care of by the core.

Here's an example when we run the test OR 1=1, the WHERE part of the generated SQL search query is:

AND 
(
    (
           (wp_posts.post_title   LIKE '%test%') 
        OR (wp_posts.post_excerpt LIKE '%test%') 
        OR (wp_posts.post_content LIKE '%test%')
    ) 
    AND 
    (
           (wp_posts.post_title   LIKE '%1=1%') 
        OR (wp_posts.post_excerpt LIKE '%1=1%') 
        OR (wp_posts.post_content LIKE '%1=1%')
    )
)

For this case we don't see the query search string breaking the SQL query.

If on the other hand you're adding your own search query, e.g. by modifying the main WP_Query by hand, then you need to watch out for possible SQL injections. The question is sparse on details, but I'm assuming that's not the case here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.