From our CRM I can generate URL's for customers that includes parameters. I want to use the information stored in this parameters to show dynamic content to the customers.

Example: www.example.com/page/?firstname=John&lastname=Doe&age=22

I need to display this information as the following:

Firstname: John
Lastname: Doe
Age: 22

For this I used the following code in my functions.php


function dynamicParameters($atts){
    //Allow to call a parameter within a shortcode
    $a = shortcode_atts( array(
        'dynamic' => ''), $atts);
    //Store the parameter in variable
    $content = $atts['dynamic'];

    //Create a span and add a piece of javascript that fills the span with the right parameter
    $result = '<span id="dynamic' . $content . '">' . $content . '</span><script> const currentURL = window.location.search; const url = new URLSearchParams(currentURL); let ' . $content . ' = url.get("' . $content . '"); document.getElementById("dynamic' . $content . '").innerHTML = ' . $content . ';</script>';

    return $result;
//Add shortcode so I can use a shortcode like [DynamicContent dynamic="exampleparameter"]
add_shortcode('DynamicContent', 'dynamicParameters');

By this I can just type the following input in my Wysiwyg-editor:

Firstname: [DynamicContent dynamic="firstname"]
Lastname: [DynamicContent dynamic="lastname"]
Age:  [DynamicContent dynamic="age"]

The script writes it all as it should be, but it will only work the first time a shortcode is used. In this case the output is

Firstname: John
Lastname: lastname
Age: age

At least it transforms the shortcodes to a certain value, but it seems like the javascript can just used one time, even though the shortcodes generates a new script for every parameter I use in a shortcode.

Does anyone know what I do wrong?

  • 1
    have you checked that the javascript it generates is what you expected, and have you checked the browser dev tools to confirm there are no errors reported? I notice that your span tags do not use unique IDs, if I were to use the same shortcode 5 times with the same attributes I would see the same ID 5 times, but IDs are meant to be unique. Any HTML validator should pick this up
    – Tom J Nowell
    Nov 15 at 15:43
  • 1
    Also, this code lets me do an XSS injection attack, I can make a user run javascript on your sites domain by putting it in one of those URL parameters, and this code will insert it into the DOM and run it. This would be a great way to steal the cookies of an administrator, or insert script tags to load bitcoin. I could even craft a URL for your site that puts a giant Islamic State flag on the page. This is all because untrusted data from the URL parameters is being passed directly into innerHTML.
    – Tom J Nowell
    Nov 15 at 15:48
  • @TomJNowell Didn't know that. What should you suggest as a saver method for innerHTML?
    – Ricardio
    Nov 16 at 8:25
  • 1
    insert a text node instead
    – Tom J Nowell
    Nov 16 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.