I am creating a Wordpress page that searches through posts based on a date variable that is set through a _GET variable. I want to make sure that I am doing this in the best way possible and that I sanitize the input correctly, I haven't worked with sanitizing php much. Here is the code I have and it functions properly. The format I need the variable in is "Monday December 17 2012" Is there more I should be doing to sanitize the GET variable? Let me know if I need to explain anything further. Thanks in advance!

if ( isset ( $_GET['new_date'] ) ) {
$display_date =$_GET['new_date'];
} else {
$display_date = date( 'l F j Y');

$next_date = date('l F j Y', strtotime('+1 Day', strtotime($display_date) ) ) ;
$prev_date = date('l F j Y', strtotime('-1 Day', strtotime($display_date) ) ) ;
<div class="large-date">
<h1><?php echo $display_date ; ?></h1>
<a class="prev-day" href="<?php echo $_SERVER['PHP_SELF'] . '?new_date=' . urlencode($prev_date);?>"><?php echo $prev_date; ?></a>
<a class="next-day" href="<?php echo $_SERVER['PHP_SELF'] . '?new_date=' . urlencode($next_date);?>"><?php echo $next_date; ?></a>

strtotime will return false if you give it weird information.

echo strtotime('<script>'); // bool(false)

However, if you do what you are doing and nest two statement you may not get what you expect.

echo strtotime('+1 day',strtotime('<script>')); // int(86400) 

And date returns the beginning of the universe, the day of creation-- January 1, 1970-- if given weird data.

echo date('1 F j Y',strtotime('+1 day',strtotime('<script>')));

So, I don't think you really have a sanitization issue, but it may not work the way you want.

That said, I'd strip every character that should not be in the date string, just in case. Maybe...

$display_date = preg_replace('/[^A-Za-z0-9+]*/','',$display_date); // assuming that you are encoding the spaces with a "+"

That will go a long way toward crippling injections, but won't give you sane dates.

I don't see anywhere that you are sending anything to the DB. You shouldn't be sanitizing your page output (though sanitizing output is good) and expecting it to carry over to when the form processes or the link gets clicked. You should be sanitizing this just before the query runs (and using prepare) but I don't see that part of the code at all.

  • Thanks for the response! At this point I am getting the result that I want in terms of using the date and strtotime functions. I just want to make sure that if someone were to set their own new_date value in the url they won't be able to gain access to things. Once the variable has been set I use it to check meta data of posts through WP_Query so I don't think I need to use prepare(based on what I read about it). I am not sending any information to the DB with this so hopefully I won't have any issues there. If date gives back odd things it just won't return any posts which is fine. Thanks! – yoxalld Dec 17 '12 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.