2
wp_signon() actually already calls wp_set_auth_cookie() which is the function that sets the "remember me" cookie, hence you don't need to manually call that function.
And that (wp_set_auth_cookie($user->ID)) is actually the problem in your code, because it's overwriting the "remember me" cookie that was already set.
2
Because there is no wp-admin.php file in WordPress:
You shouldn't be able to login via wp-admin.php, it should not exist!
Be extremely suspicious of this file, you may have been hacked, and have likely leaked your details to an attacker.
1
Looks like it would work! I ended up using something like this:
if( !($some_variable === 'uk' || $another_variable === 'in')){
//this occurs when neither of the above are true
}
courtesy of a comment by @Habchi on this thread: https://stackoverflow.com/questions/19949923/simpler-way-to-check-if-variable-is-not-equal-to-multiple-string-values I'll post ...
1
|| means OR.
Your code will never allow $current_user to proceed because one of the OR conditions will fail.
Try using AND && instead:
if ( ($current_user->user_login != 'john') && ($current_user->user_login != 'sheila' ) ) {
1
wp-login.php should not require additional effort from you to secure. However, I don't think that's what you client is asking for.
My question therefore is does Wordpress require further development to
stop SQL injections etc on login forms? And do I need to apply input
sanitation to the login fields?
To wp-login.php, no, you don't. Not for security ...
Only top voted, non community-wiki answers of a minimum length are eligible
