PHP $_SERVER variables are not safe for use in forms, links

Report a Broken Link or Offensive Content

Processing your request, Please wait....

Monday, 21 September 2009

Read Article

A common security mistake I see WordPress plugin authors (and PHP coders in general) make is using $_SERVER['PHP_SELF'] or $_SERVER['REQUEST_URI'] as the action of a form or part of an anchor’s href attribute. This is not safe to do, and opens your code up to XSS (cross-site scripting) exploits.
Common example:

Another example:

<a href="<?php echo $_SERVER['PHP_SELF']‘ ?>?foo=bar">link title</a>

Here are my two rules regarding $_SERVER['PHP_SELF'] or $_SERVER['REQUEST_URI'] in forms:

Do not use them
If you use one of them, escape it with esc_url()

Most uses of $_SERVER['PHP_SELF'] and $_SERVER['REQUEST_URI'] are in HTML forms. If you want the action attribute to point to the current URL, leave it blank. URI references that are blank point to the current resource.

If you do want to specify the action (and there are good reasons for wanting to do that, such as stripping the query string…

By: Mark Jaquith
From: Mark on WordPress

Read Article

You Might Also Like...

Escaping API updates for WordPress 2.8

161 readersThe WordPress escaping API functions have been updated. Escaping is a way of using untrusted text that “neuters” anything that could do damage. Escaping is used in WordPress to avoid SQL injection and cross-site scripting/script injection (XSS), among other things. The old functions still work, so if you were using the old ones, you’re fine.
Use WordPress Login

52 readersWordPress makes it pretty easy to log in and out of WordPress in a theme. Basically with two functions <?php $redirect = 'wp-admin/post-new.php'; if ( !is_user_logged_in() ) { $link = '<a href="' . esc_url( wp_login_url( $redirect ) ) . '">' . __('Login') . '</a>'; } else { $link = '<a href="' . esc_url( wp_logout_url( $redirect
How To: Build a Categories and Archives Drop-down Box

171 readersOver the past couple years I’ve really enjoyed monitoring trends in the blogosphere and one of the trends that has come up recently is blogger’s cleaning up their sidebars by adding drop-down boxes. If you’d like to build drop-down boxes for your categories and archives on your WordPress blog, here is the code you need: Archives Drop-down
How to easily monitor your web server using PHP

2110 readersIn order to make sure that your website is always available to the public, you have to monitor it. In this tutorial, I'll show you how you can easily create a monitoring script that will check your website availability and send an email or sms alert to you if it isn't.Like CatsWhoCode? If yes, don't
How to Build a Top Sliding Login Panel

581 readersMany times, I get requests from my clients who want to implement a Sliding Login Panel at the top of their WordPress blogs. With jQuery and the WordPress default login code, its very easy to build. Here is what it will look like :- DEMO SLIDING LOGIN PANEL The above demo is only HTML code
Redirects To Another Page In WordPress Backend

68 readersWordPress allows using a function, to simple redirect to a URL, the function wp_redirect() enables to specify an address and a status. This makes it easy to realize a forward even in the backend of WordPress. Two different examples will illustrate this. The difference lies in the query of the URL, which will be checked.
How to Highlight Search Terms with jQuery

339 readersA neat way to spice up your WordPress search page is to highlight search terms within your search results. I’ve seen some tutorials on the net on how to do this, but I haven’t found one that highlights both title and post content and is a drop-in modification for WordPress. Today I will bring you
Creating a Tumblog with WordPress

2432 readersFor the recent (first) design of my personal site I added in some Tumblr style functionality. In this post we'll look at how WordPress can be used to create a Tumblog.
10 jQuery snippets for efficient developers

680 readersjQuery is by far my favorite Javascript framework, which allows developers to create stunning visual effects, manipulate data properly, and much more. In this article, I have compiled 10 extremely useful jQuery snippets.Have you checked out the highly recommended Digging into WordPress book by Chris Coyier and Jeff Starr?10 jQuery snippets for efficient developers
Themes and automatic_feed_links

57 readersSince WordPress 2.8, there is the function automatic_feed_links() in the function.php. Which writes the link elements for the RSS protocols in the header of the document. The advantage of this feature is, you do not need to worry about whether a change comes in the Feed-protocoll in a new version of WordPress, removed or a