rest-api

register_rest_field update_callback don’t work for $_FILES

I found a solution but i’m sure there is a better way. I add an action on rest_insert_<post_type> hook add_action( ‘rest_insert_project’, ‘prefix_update_files_field’, 10 , 3 ); function prefix_update_files_field($post, $request, $true){ global $wp_rest_additional_fields; $my_post_type=”project”; $additional_fields = $wp_rest_additional_fields[$my_post_type]; foreach ( $additional_fields as $field_name => $field_options ) { if ( ! $field_options[‘update_callback’] ) { continue; } // Don’t … Read more

Should I worry about SQL injection when using REST API?

Yes. This is not secure at all. You’re putting user input directly into a database query. You need to use $wpdb->prepare() if you’re inserting user input into SQL: $post_slug = $request->get_param( ‘slug’ ); $query = $wpdb->prepare( “select * from wp_posts where post_name=%s and post_status=”publish” limit 1;”, $post_slug ); $results = $wpdb->get_results( $query );

+ More
Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)