I'm using WordPress Multisite with multilingualpress.

In order to get the href, outside of my navbar, to the page with the appropriate language, I am using an SQL query that queries $wpdb within the short codes.

global $wpdb;
$blogid = get_current_blog_id();
$result = $wpdb->get_results("SELECT * FROM `wp_multilingual_linked` WHERE `ml_source_elementid` = '360' and `ml_blogid` = $blogid");
foreach($result as $row) {
    $your_page_link = get_the_permalink($row->ml_elementid);

Is there any inherent security flaw with querying $wpdb within the shortcodes?



No, there is no inherent security flaw in $wpdb, or using it within a shortcode. However, you can introduce vulnerabilities if you aren't careful how you use it. There are primarily two issues that you should be thinking about.

The first is escaping. You need to make sure that any potentially user-controlled values are escaped when they are used in the query. The best way to do this is with prepared statements and $wpdb->prepare(). In your code, this isn't a necessity, since the value returned by get_current_blog_id() should be safe. However, it is a good habit to be in anyway:

$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM `wp_multilingual_linked` WHERE `ml_source_elementid` = '360' and `ml_blogid` = %d", $blogid ) );

The other thing that it is sometimes important to consider is whether your query is possibly going to expose information to users that it shouldn't. For example, you wouldn't want to leave open the possibility of exposing private posts to other users. In your case, I don't think this is an issue because you aren't querying data that might be restricted. But it is a good thing to keep in mind, so that in cases where it is necessary you can put the proper capability checks in place, rather than inadvertently exposing privileged information to unprivileged users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.