I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET
variable or $_REQUEST
variable.
Depending on what the variable is set to, it will call a certain class method to handle the user’s request and display the proper content.
I am fully aware of the Data Validation page on the WordPress Codex, however, I am unsure of what the best approach is for my scenario, or any scenario of sanitizing $_GET
variables or $_REQUEST
variables for that matter.
How can I sanitize using WordPress functions for $_GET
variable or $_REQUEST
variable for a string which will be matched to call a specific class method?
Could this be exploited or fail given the following code?:
public function display_admin_page(){
if(is_admin() && isset($_GET['page'])){
global $content;
$page = sanitize_title($_GET['page']);
$method_name="page_".str_replace('-', '_', $page);
if(method_exists('content', $method_name)){
// Display requested page from content class
$thePage = $content->$method_name();
} else{
$thePage = $content->error(404);
}
echo $thePage;
}
}