security

Insert NULL value using prepare()

the quick solution I found is to str_replace empty value. /* Query */ global $wpdb; $tablename = $wpdb->prefix . ‘data’; $sql = $wpdb->prepare( ” UPDATE $tablename SET `date` = %s, WHERE id= %d “, $_POST[‘date’], $_POST[‘id’] ); // SQL = UPDATE prefix_data SET `date` = ” WHERE id = 1 $sql = str_replace(“””,’NULL’, $sql); // … Read more

SQL queries to another wordpress site

Putting an important credentials in functions.php is not a good idea. The better way is you can utilize WP REST API from your second site to handle GET and POST method for the data and using global $wpdb variable inside the code. You can either create a custom endpoint for that by making a custom … Read more

wp_nonce vs jwt

What I haven’t thought of is that I could use wp_nonce instead of jwt – create nonce on backend, store it on frontend and send it with every request till it expires. What drawbacks does wp nonce method have vs jwt method? Using nonces as a replacement for an authentication protocol, or as a session … Read more

sanitize_post() is not sanitizing Post Object

Solution: sanitize_post is coming with “display” default filter option. And it does not sanitize tags. But if you tries a code like this: $sanitizer = function($post){ return sanitize_post($post, “db”); // or “edit” }; array_map($sanitizer, $data[“post”]); Now it sanitizes fields against XSS!

+ More