Scribd
Upload
120 views

Get URL Query Parameter Values in WordPress To Use With Plugins - Themes

This document provides a function for properly retrieving values from URL query parameters in WordPress. The function first checks if the requested parameter is set, and if not, returns a default value. If set, it removes slashes using wp_unslash and sanitizes the value using strip_tags to prevent XSS vulnerabilities. Using this function is preferable to directly accessing $_REQUEST due to WordPress adding slashes and the need to sanitize input.

Uploaded by

Leonardo Costa
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
120 views

Get URL Query Parameter Values in WordPress To Use With Plugins - Themes

This document provides a function for properly retrieving values from URL query parameters in WordPress. The function first checks if the requested parameter is set, and if not, returns a default value. If set, it removes slashes using wp_unslash and sanitizes the value using strip_tags to prevent XSS vulnerabilities. Using this function is preferable to directly accessing $_REQUEST due to WordPress adding slashes and the need to sanitize input.

Uploaded by

Leonardo Costa
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

  SEARCH

INTECHGRITY
TECHNOLOGY POWERING THE WEB

The correct way to get URL para-


meter values in WordPress
Swashata March 1, 2017

URL query parameters really come in handy. For example, in eForm we use data from query
parameters to pre­populate/prefil form elements.

But what is the most effective, foolproof way to get the data? Is a simple  $_REQUEST[
$key ]  enough? Of course not. The reasons being:

WordPress adds slashes to the $_REQUEST array before­hand. So even if magic
quote is turned off, you will get slashes.
The raw data can expose to cross site vulnerability like XSS.
So I put together a really simple function to properly get values from the URL parameters.
You can use it whereever you like.

01 <?php ?
02 /**
03  * Gets the request parameter.
04  *
05  * @param      string  $key      The query parameter
06  * @param      string  $default  The default value to return if
07  *
08  * @return     string  The request parameter.
09  */
10 function get_request_parameter( $key, $default = '' ) {
11     // If not request set
12     if ( ! isset( $_REQUEST[ $key ] ) || empty( $_REQUEST[ $key
13         return $default;
14     }
15  
16     // Set so process it
17     return strip_tags( (string) wp_unslash( $_REQUEST[ $key ] )
18 }

Here three things are happening.

First we check if the request key is present or not. If not, then just return a default
value.
If it is set, then we first remove slashes by doing  wp_unslash . Read here why it is
better than  stripslashes_deep .
Then we sanitize the value by doing a simple  strip_tags . If you expect rich text
from parameter, then run it through  wp_kses  or similar functions.
Intelligent Log Using PHP GET and Rentberry Token Pre­ WordPress User Data
Analytics POST simultaneously Sale & User Meta objects
via single HTML form through single...
Ad logz.io intechgrity.com Ad Rentberry intechgrity.com

Atualização High PHP HTTP interaction Single index.php PHP Create WordPress


Sierra /w HTML form using script to load different custom menus and
GET and POST... page using URL... display in theme...

Ad Setapp intechgrity.com intechgrity.com intechgrity.com

CATEGORIES WP Programming

TAGS snippet

Previous article
Get userdata object & user meta
through single function call

Sponsors
  

Advertise Here

Advertise Here

You might also like