rest-api

Get user in rest API endpoint

Thanks to Jacob Peattie, I was able to solve this issue. You have to include a nonce from the WordPress Javascript API in your REST API requests if you wish to use information about the current user. From the WordPress documentation: If no nonce is provided the API will set the current user to 0, … Read more

register_rest_field update_callback don’t work for $_FILES

I found a solution but i’m sure there is a better way. I add an action on rest_insert_<post_type> hook add_action( ‘rest_insert_project’, ‘prefix_update_files_field’, 10 , 3 ); function prefix_update_files_field($post, $request, $true){ global $wp_rest_additional_fields; $my_post_type=”project”; $additional_fields = $wp_rest_additional_fields[$my_post_type]; foreach ( $additional_fields as $field_name => $field_options ) { if ( ! $field_options[‘update_callback’] ) { continue; } // Don’t … Read more

Should I worry about SQL injection when using REST API?

Yes. This is not secure at all. You’re putting user input directly into a database query. You need to use $wpdb->prepare() if you’re inserting user input into SQL: $post_slug = $request->get_param( ‘slug’ ); $query = $wpdb->prepare( “select * from wp_posts where post_name=%s and post_status=”publish” limit 1;”, $post_slug ); $results = $wpdb->get_results( $query );

+ More