I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable.

Depending on what the variable is set to, it will call a certain class method to handle the user’s request and display the proper content.

I am fully aware of the Data Validation page on the WordPress Codex, however, I am unsure of what the best approach is for my scenario, or any scenario of sanitizing $_GET variables or $_REQUEST variables for that matter.

How can I sanitize using WordPress functions for $_GET variable or $_REQUEST variable for a string which will be matched to call a specific class method?

Could this be exploited or fail given the following code?:

public function display_admin_page(){
    if(is_admin() && isset($_GET['page'])){
        global $content;
        $page = sanitize_title($_GET['page']);
        $method_name="page_".str_replace('-', '_', $page);
        if(method_exists('content', $method_name)){
            // Display requested page from content class
            $thePage = $content->$method_name();
        } else{
            $thePage = $content->error(404);    
        }
        echo $thePage;
    }
}

4 s
4

WordPress doesn’t provide any specific data validation functions for SUPERGLOBALS.

I use the PHP filter_input function then escape it as I would any untrusted variable.

$url = filter_input( INPUT_GET, 'some_query_string', FILTER_VALIDATE_URL );

echo '<a href="'. esc_url( $url ). '">Click Me</a>';

The PHP filter input accepts:

  • Validate filters
  • Sanitize filters
  • Other filters
  • Additional Filter flags

Leave a Reply

Your email address will not be published. Required fields are marked *