Passing Variable as URL Parameter — Security concerns?

Passing non-private/non-protected/non-sensitive values through the URL is quite widely used and a more reliable way of passing values from one page to another. The reason for this is, $_SERVER[‘HTTP_REFERER’] is totally unreliable and can never be trusted. It can also, in many case be an empty value. Check the two following posts for more details … Read more

Custom query_var causes displaying posts archive on front page

After detailed debugging of WP::parse_request() and WP_Query::parse_query() I found out that unset( $query_vars[‘date’] ); in ‘request’ filter helps. It basically unsets date query var before WP_Query::parse_query() is invoked so is_home() returns false. add_filter( ‘request’, function( $query_vars ) { global $wp_query, $wp; if ( ! $wp_query->is_main_query() ) { return $query_vars; } $qv_keys = array_keys( $wp->query_vars ); … Read more

Filtered query_vars becomes global. Why does this work?

Within the WP::parse_request() method (src) we locate the query_vars filter: $this->public_query_vars = apply_filters( ‘query_vars’, $this->public_query_vars ); and within WP::register_globals() we can see why it becomes globally accessible (src): // Extract updated query vars back into global namespace. foreach ( (array) $wp_query->query_vars as $key => $value ) { $GLOBALS[ $key ] = $value; } where the … Read more

paginate_links ignore my format

This part: ‘base’ => str_replace( 999999999, ‘%#%’, esc_url( get_pagenum_link( 999999999 ) ) ), is generating a page part like this one: ‘base’ => http://example.tld/page/%#%/ If we peek into paginate_links() we see the default: ‘base’ => $pagenum_link, // http://example.com/all_posts.php%_% : // %_% is replaced by format (below) ‘format’ => $format, // ?page=%#% : %#% is replaced … Read more

How to correctly escape query variables to be used in WP_Query

The function for the pre_get_posts action uses a WP_Query object (http://codex.wordpress.org/Plugin_API/Action_Reference/pre_get_posts) When using functions such as get_posts or classes such as WP_Query and WP_User_Query, WordPress takes care of the necessary sanitization in querying the database. However, when retrieving data from a custom table, or otherwise performing a direct SQL query on the database – proper … Read more

get_query_var function not working at all

WordPress doesn’t automatically add all query string params ($_GET params) as query_vars. When Query Var somevar is not registered: example.com/some-page/?somevar=hello – WordPress ignores somevar When Query Var somevar is registered: example.com/some-page/?somevar=hello – WordPress stores the value of this param in the $wp_query->query_vars array The difference between registering that variable with WordPress is whether the value … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)