I'm creating a fairly simple wordpress plugin and I feel the code below is sufficiently safe from SQL injection, but a friend of mine very vaguely said that it wasn't without elaborating and now I'm second guessing myself.
Is the following safe? What's below is literally the entire contents of, say for example, final.php and it is included in another file.
list($eid, $uid, $u, $an) = explode(';', base64_decode($_GET['q']), 4);
$wp->insert(INFO_TABLE,
array(
'eid' => $eid,
'uid' => $uid,
'u' => $u,
'an' => $an,
)
);
header('Location: ' . $u);
Yes, you're safe, using $wp->insert is enough, it passes through the API and it will handle the sanitization for you.
The good news is that if you use any of the helper functions, then you don’t need to do anything, the query is escaped for you. If you use the query() method, however, you will need to escape manually, using the prepare() method.
source: http://www.smashingmagazine.com/2011/09/21/interacting-with-the-wordpress-database/
Always validate any $_POST or $_GET submitted content. SQL injection in only 1 issue. At the very least someone could encode "buy viagra pills",etc,etc,etc and pass it unlimited amount of times to your database using the code above.