Please i need a security advice on how i created and is displaying my forms using php, i want to know from the security point of view if my below code is unsecured from cross scripting attacks or sql injections or any form of exploitation or hack.

$form = '<div class=demessage>' . esc_html__($message, "gold") . '</div>' ;

$form .= '<form action="" method="post" name="base">';
$form .= esc_html__("username:"). '<input type="text" name="username" value="'. esc_html__($username) . '" id="dn1" class="dclogin"/>';
$form .= esc_html__("Password:"). '<input type="text" name="password" value="'. esc_html__($password) . '" id="dn2" class="dclogin"/>';
$form .= '<input type="submit" name="submitlogin" class="submitlogin" value="'.esc_html__("Login now", "gold") . '" />';
$form .= '</form>';

1 Answer 1


It's not the code in the form, but how you process the form's data.

I put this in my main 'include' file; it sanitizes all input data. The key is to never trust the form data without verifying it is valid. This code helps in that.

// this sanitizes all gets/posts for security
$_GET = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);

The googles/bings/ducks have lots of resources on sanitizing data. But the above is a good start, IMHO.


The code you have on the input form doesn't protect anything. It's not needed.

The protection that is needed is on the form processing side, whichever page that is. And the filter_input_array statements need to be on that form processing page.

The only possible thing that your code does is filter the variables you use in the 'value' element of the input tag. For example, if $name is the name that someone filled in, and the form didn't process, or you have previously defined $name, then you code might protect those values.

But the real protection is in your code that you use to process the page. My filter_input_array statements will help with that, but you should further ensure that the variables are 'safe'.

(BTW, this is not really a WordPress Development question. It might be better to research over on the Stack Overflow forum.)


Note that the FILTER_SANITIZE_STRING is deprecated/invalid in PHP 8.x, so using it will cause an error.

  • Thanks @Rick, it means my code is okay on the front end and no malicious code can be inserted or added to the code? also how do i use this $_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);, where do i put the code, is it in the php file that processes the form and do i have to reference the form name while adding the code?
    – pandglobal
    May 25, 2020 at 1:07
  • (See info added to my answer) May 25, 2020 at 1:52
  • Thanks alot @rick your response was better explained. I will run the filter post code in the same processing page so to sanitize the values am sending to database or working with, thanks alot.
    – pandglobal
    May 25, 2020 at 7:28
  • No problem. It is 'polite' here to support correct answers with an up vote or check mark. It expresses appreciation for the answer, and tells others with a similar issue that the answer was what you were looking for. May 25, 2020 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.