2

I submit search data to a custom page searchi.php

<?php
    //
    $search_variables = $_GET['s']. '+' .$_GET['cat'];

    //This sends http post to url without curl
    header("Status: 301 Moved Permanently");
    header("Location:http://localhost/wordpress/?s=$search_variables");
    exit;

?>

I know wp_query sanitizes variables for me, so I should not worry about it. But it is better to ask than be sorry, is there any way this would compromise security?

I noticed echoing variable $search_variables with <div></div> inserted through search form works, so should I do something about it?

9

No. WordPress sanitizes the search query.

To use the sanitized search query, use the_search_query() to echo, or get_search_query() to return, the search query.

Edit

Based on your edit:

  • Don't use $_GET['s']. Use get_search_query().
  • Don't use $_GET['cat']. Use get_the_category().
  • All $_GET and $_POST data should be assumed to be inherently unsafe, and should be sanitized/validated accordingly.
2
  • But, searchi.php is not part of wordpress, and 'cat' is not a real category, I'm using relevanssi plugin to match complicated strings. So I need this extra outside page that just puts two input content into 1 and submit it back to wp search. Honestly I don't see problem with my current implementation, I do use GET but the contents of GET goes to original wp search query anyways, so where is the risk? More detail would be appreciated on the matter.
    – user8842
    Aug 30 '12 at 19:39
  • "I do use GET but the contents of GET goes to original wp search query anyways" - I'm not sure how to answer any more clearly. If you want assumed safe, use get_search_query(); if you use $_GET data, you should assume that it is unsafe and treat it accordingly. Aug 30 '12 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy