0

I have a basic page template that i'm willing to 'convert' to a dynamic one.

What I mean is that I have an external table within WordPress's database that holds some data, And what I intend to accomplish is to make this page be able to receive $_GET parameters and then generate some table based on this external table's data.

I haven't started to write any code yet, since I'm still trying to understand the best approach to this:

1) Should I make the $wpdb calls within the page's template itself and then cross-data between the received $_GET parameter ?

2) Should I move this table out of WordPress's database and create a totally new database to connect with?

3) How secure will it be to depend on $_GET parameters in order to generate the page's content (using the page's template)? After sanitization etc..

0

1) If all output will happen in that one template, I don't see why you can't do everything in the template. How it's organized is really up to you.

2) If the table is in the WordPress database, it certainly simplifies things, you won't have to create a connection to another database.

3) It's up to you to validate user input. If you expect an integer, make sure that's what you have. PHP has a number of functions to assist with this, and WordPress has some functions to assist with this as well. Your queries should use prepare in any case to prevent SQL injection.

You also need to secure output, which WordPress can help you with as well.

  • First of all, thanks for your response! The only last thing that concerns me is whether these DB calls should be done -directly- from the page's template or should i register some hooks first and then use them within the template? I mean.. How secure will it be to actually write this $results = $wpdb->get_results... inside the template's file?.. – Gonras Karols May 29 '17 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.