All text entered into the database is, in essence, “user entered”. If the site gets hacked a hacker could change every instance of the field “title” to contain javascript, for example. If you just echo out the field then you’re writing the javascript to the page and thus injecting the code into the page. Therefore, … Read more
How do I make secure API calls from my WordPress plugin?
Yes. This is not secure at all. You’re putting user input directly into a database query. You need to use $wpdb->prepare() if you’re inserting user input into SQL: $post_slug = $request->get_param( ‘slug’ ); $query = $wpdb->prepare( “select * from wp_posts where post_name=%s and post_status=”publish” limit 1;”, $post_slug ); $results = $wpdb->get_results( $query );
Site infected by link
WP Snippet to Hide Theme Editor In Dashboard Only Works On LocalHost Site
Bing/msn bots is heavily requesting random of my website
How to invalidate `password reset key` after being used
whether a nonce is required for get type and get_query_var?
Have you identified the exploit vector? If not, you may be leaving yourself open to future exploit. Other things to consider: Change WordPress admin user passwords – done Change Hosting account user password Change FTP passwords Change MySQL db user password – done Change the db table prefix Update your wp-config nonces/salt Check your directory/file … Read more
From the answer in Password protect a specific URL, we can reverse the condition. To quote his answer, You should be able to do this using the combination of mod_env and the Satisfy any directive. You can use SetEnvIf to check against the Request_URI, even if it’s not a physical path. You can then check … Read more