I’m building my site locally.

Since I want users to be able to write only specific terms in the search bar, I put a jQuery script in the wp-content\themes\sitename\js folder. The script works fine, but I noticed that the script can be bypassed in a simple way.

For example, suppose that the search bar accepts only strings with 3 characters, so if I write abcd and press enter I get an error, but if I write abc and press enter then it works and the Search Results page will have the url


But it’s enough to modify the url to be


and press enter, to bypass the search bar script.

How to avoid this?

I have 2 ideas, use the function get_search_query, or remove the keyword from the url so that independently from the keyword the url will be, for example


But I don't know how to use the function or how to remove the keyword from the url (if it is possibile).

  • 2
    This would need to be implemented in the server side PHP, a JS based solution might provide client-side validation, but you shouldn't rely on client-side restrictions to enforce things – Tom J Nowell Jun 14 '19 at 13:33
  • Thank you for the comment. So isn't enough to show an error page when the search query does not respect the rules set in my .js file? Or, is there a way to know if the search query was inserted in the url rather than in the search bar, and then show an error page where it is written that searches through url editing is forbidden? Thanks – sound wave Jun 14 '19 at 17:53
  • 1
    Look at it this way, if I turn off JS in my browser or your JS file fails to load, nothing would stop me breaking your validation rule, so it has to be server side – Tom J Nowell Jun 14 '19 at 18:03

You want to use the pre_get_posts action to modify the search query on the server side. The pre_get_posts Codex have some examples to get you started.

To target the main search query, try this:

function my_search_filter( $query ) {
    if ( ! is_admin() && $query->is_main_query() ) {
        if ( $query->is_search ) {
            // Use $query->set(); to do stuff here.
add_action( 'pre_get_posts', 'my_search_filter' );
| improve this answer | |
  • Thank you for the reply. I don't understand two things. (1) What does it mean server side for a localhost site? (2) Why do I need to modify the search query using pre_get_posts? Isn't enough to show an error page when the search query does not respect the rules set in my .js file? – sound wave Jun 14 '19 at 17:49
  • 1
    1. PHP files. 2. As Tom mentioned, you can circumvent javascript intentionally or unintentionally very easily. Anything on the client side (js,html,css) can be modified. PHP and data in Mysql cannot be modified by the end user. For these reasons, it's not enough to attempt to build this functionality in js. Using the method I've outlined, you can modify the search query using PHP before it gets to the database. – MikeNGarrett Jun 14 '19 at 18:02
  • Thank you very much I didn't know about the difference, now it's more clear. So I'd like to ask you one more thing. A lot of files in the theme directory are .php, (for example search.php, index.php, functions.php, etc.), do you mean that all these files cannot be modified by the end user, while other files such as .js and .css can be modified (for example, by using the Inpect tool of the browser) and so are less secure? – sound wave Jun 14 '19 at 23:07
  • 1
    Yes. That's correct. – MikeNGarrett Jun 14 '19 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.