I am using loops as means of displaying personal meta and customer information on the frontend.

For example, I have a page which displays a user's 'profile' information to edit. Their profile is custom post type that was created when the registered. The loop for the edit screen finds the one cpt based on the current user id, populates the form fields, and after submission updates the post. Is this secure?

If not what some better ways to handle this type of action?

*--Edited to include example code

Here is a sample loop. This is pulling in a vendor's items they sell. The GF hooks pre-populate the form in the middle with the meta from the product, after submission the post is updated.

$q = new WP_Query( array( 'author' => $current_user->ID, 'post_type' => 'product' ) );
  if ( $q->have_posts() ) {
      while ( $q->have_posts() ) {
         $q->the_post( ); ?>

         <div id="<?php the_id(); ?>" class="tab_content_trip" style="display:none;">
               <?php echo do_shortcode('[gravityform id="7" title="false" description="false"  ajax="true"]'); ?>

        <?php }
} ?>

So my question is if it is possible for someone to somehow hijack a loop like this and edit other users posts in some way? (of course not including if they somehow steal their password, or something of that nature)

Essentially, I am seeking some insight on best practice for securely filtering user information to be displayed on the frontend

  • 2
    »It is secure to lock the door when I leave my home?« ... »YesNo.« ... as it depends on the lock, the door... and if you have left a window wide open. How should we tell without seeing the code?
    – kaiser
    Commented Oct 17, 2012 at 2:40
  • Hi Kyle this will probably be closed unless you have a specific question or would like to clear up what your trying to ask.
    – Wyck
    Commented Oct 17, 2012 at 3:03
  • Added edits to give more detail to my question
    – Kyle
    Commented Oct 17, 2012 at 17:55

1 Answer 1


This loop looks pretty sure to me. You aren't exposing any raw SQL anywhere, so injection attacks shouldn't happen.

  • Thanks for the reply Eric. Okay great, I will look into that area. This is a topic I have not been able to find discussed much, so I appreciate the input.
    – Kyle
    Commented Oct 17, 2012 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.