2

I have created a table on a wordpress database, This database table should have 2 columns.

One for postcode and one for a URL

If the postcode is found in the database, redirect to the corresponding URL

I am inserting rows from my plugin but I cannot select from this table.

Select return always error.

The insert that is working this is the action.php`

this is the form with shortcode

<?php

if ( !defined( 'ABSPATH' ) ) exit;

register_activation_hook( __FILE__, "activate_myplugin" );
register_deactivation_hook( __FILE__, "deactivate_myplugin" );


function activate_myplugin() {
    init_db_myplugin();
}


function postcode_form_function() { 
?>
        <form  method="GET" action="<?php echo plugins_url('action.php', __FILE__ ); ?>">
    <label>postcode</label><input type="text" pattern="[0-9]{5}" title="Five digit zip code" />
    <button name="submit">submit</button>
    </form>
<?php
} 

// register shortcode
add_shortcode('postcode_form', 'postcode_form_function'); 
?>

When I try to select from this table I am taking nothing

<?php  require('../../../wp-blog-header.php');

if(isset($_POST['submit']))
{
    $postcode = $_POST['postcode'];
    // search in all table columns
    $query = "SELECT url 
    FROM wp_4_customer
    WHERE $postcode =postcode 
    ";
    $search_result = submit($query);
    
} else {
   echo 'error';
}

// function to connect and execute the query
function submit($query)
{
    global  $wpdb ;
    $search_result = $wpdb->get_results($query);
    foreach($search_result as $row){`enter code here`
        header('Location: '.$row['url']);
    }
}
?>
7
  • 2
    Assuming your postcode value is not purely numeric, then this is obviously missing the quotes. And this is totally lacking any SQL injection prevention. Commented Jun 20, 2022 at 13:45
  • WHERE $postcode =postcode is wrong and needs to be swapped to WHERE postcode = '$postcode' Commented Jun 20, 2022 at 13:45
  • @MarkusZeller no, SQL does not really care about that. columname = value and value = columname are the same thing. Commented Jun 20, 2022 at 13:47
  • Tidy code demonstrates the possibility of a logical mind :) Commented Jun 20, 2022 at 13:55
  • please see - stackoverflow.com/questions/601300/what-is-sql-injection. the only protection you have from this is the pattern set on the input, which doesn't prevent raw submission of values like '' OR 1 from being submitted. Which can easily be done using something like postman or any rest client. see also developer.wordpress.org/reference/classes/wpdb/prepare Commented Jun 20, 2022 at 14:16

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.