search

lesterchan / wp-polls

Adds an AJAX poll system to your WordPress blog. You can also easily add a poll into your WordPress's blog post/page.
https://wordpress.org/plugins/wp-polls/
93 stars 78 forks source link

SQL injection fixes. #61

Closed jaydansand closed 8 years ago

jaydansand commented 8 years ago

This commit does the following: Fix possible rDNS SQL injection (gethostbyaddr() - tough but possible to do; definitely not low-hanging fruit). Use $wpdb->prepare() where appropriate. Use esc_sql() instead of addslashes(). Whitelist ORDER BY and SORT BY SQL injection vectors.