Secure Coding with
WordPress
Mark Jaquith
markjaquith.com

\">link
Mark Jaquith
markjaquith.com

$ sudo wp-plugin

That thing that the
Uncle dude told the
Spiderman dude

XSS privilege
escalation
CSRF
SQL injection

SQL Injection

I CAN HAZ REFUND?

query(
\"UPDATE $wpdb->posts
SET post_title = '$newtitle'
WHERE ID = $my_id\"
);
?>

escape( $newtitle );
$my_id = absint( $my_id );
$wpdb->query(
\"UPDATE $wpdb->posts
SET post_title = '