Sometimes a plugin developer might want to submit a form back to itself. Or perhaps they want to link back to the current page, except with a variable in the query string. Often enough, you’ll seem them do it this way.
1 | <form method=POST action='<=$_SERVER['PHP_SELF']?>'> |
or
1 2 3 4 5 6 7 | <a href='<?=$_SERVER['REQUEST_URI']?>'>Click Here</a>{/code} The problem with this code is that it's easily exploitable. Remember, the behavior for REQUEST_URI and PHP_SELF are to take whatever the entrance URL was and return it to the caller. So how can this effect your pages? Since the user can append anything that they'd like to the initial entrance URL, it becomes the vector for attack. So how can you submit forms and links back to themselves without these variables? For forms, just leave the action blank or don't include it at all. <pre lang="html4strict"><form method=POST> |
<form method=POST action=''> |
And for links, using the # sign will link back to your current page.
<a href='#'>Click here!</a> |
If a plugin developer absolutely MUST use server variables, just make sure to escape them accordingly. Use the WordPress function esc_url().
1 | <a href='<?=esc_url($_SERVER['PHP_SELF']?>'>Click Me!</a> |
In reality, it’s bad practice to use the PHP $_SERVER variables at all. So try to avoid doing it at all costs.