Wordpress SQL search, how to handle SQL Injection?

The default public search query variable is s but not q.

So when you use q, on a vanilla WP install, no posts filtering is done, as expected.

You don’t have to take care of possible SQL injections, for the default search query, as it’s taken care of by the core.

Here’s an example when we run the test OR 1=1, the WHERE part of the generated SQL search query is:

AND 
(
    (
           (wp_posts.post_title   LIKE '%test%') 
        OR (wp_posts.post_excerpt LIKE '%test%') 
        OR (wp_posts.post_content LIKE '%test%')
    ) 
    AND 
    (
           (wp_posts.post_title   LIKE '%1=1%') 
        OR (wp_posts.post_excerpt LIKE '%1=1%') 
        OR (wp_posts.post_content LIKE '%1=1%')
    )
)

For this case we don’t see the query search string breaking the SQL query.

If on the other hand you’re adding your own search query, e.g. by modifying the main WP_Query by hand, then you need to watch out for possible SQL injections.
The question is sparse on details, but I’m assuming that’s not the case here.

Related Posts: