WordPress SQL Injection URL parameter

Question

I wrote a very little WordPress application that uses URL parameter values to generate html content on a public site like this:

URL example:

www.mydomain/?prmtr=Chicago

Code:

$prmtr = isset( $_GET['prmtr'] ) ? $_GET['prmtr'] : 'NewYork';

A possible HTML integration is like this

<h1>Hello Person from <?php echo $prmtr; ?></h1>

Is WordPress doing all the "dirty work" for me, like preventing attackers from injecting SQL commands or other stuff?

Thanks in advance, Ben

Are Chicago, NewYork these kinds of values exists in database then you should match them once after get from URL with database. If exists then display else ignore or use default case. — Deep Kakkar
– Deep Kakkar, Commented Jun 3, 2015 at 8:34

thelastshadow · Accepted Answer · 2015-06-03 08:29:30Z

3

Nope. That's raw PHP you've got there. You'll have to make it safe yourself.

As long as all you're doing with $prtmr is printing it out you don't need to worry about SQL injection, just XSS attacks.

answered Jun 3, 2015 at 8:29

thelastshadow

3,6604 gold badges37 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1