0

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?

list($email_id, $user_id, $url, $anchor) = explode(';', base64_decode($_GET['r']), 4);
$wpdb->insert(NEWSLETTER_STATS_TABLE,
    array(
        'email_id' => $email_id,
        'user_id' => $user_id,
        'url' => $url,
        'anchor' => $anchor
    )
);
1

wpdb::_insert_replace_helper() will escape the data:

return $this->query( $this->prepare( $sql, $data ) );

But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.

3
  • Plus, the base64 code is retrieved from a $_GET query far! Do not use this code!
    – shea
    Jan 10 '13 at 8:28
  • 1
    @bungeshea There is nothing wrong per se with base 64, it is just hard to read.
    – fuxia
    Jan 10 '13 at 10:46
  • I know that base64 in itself is okay, but the retrieving-from-$_GET part bothered me.
    – shea
    Jan 10 '13 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.