How to fix the base64_encode and base64_decode to avoid injection?
<p>I am using a theme option for WordPress with base64_encode and base64_decode. Since base64_ risk for the code injection, need to change that code.
Actually I have no idea how to do that.</p>

<p>The code contain base64_encode is like this:</p>

<pre><code>                    new AjaxUpload(&lt;?php echo ($value['id']); ?&gt;, {
                        action: '&lt;?php echo THEME_DIR; ?&gt;/admin/upload-file.php',
                        name: '&lt;?php echo ($upload_security)?&gt;',
                        data: {
                            upload_path : '&lt;?php echo base64_encode(UPFW_UPLOADS_DIR); ?&gt;'
                        },
                        onSubmit: function(file, ext){
                            //Check if file is an image
                            if (! (ext &amp;&amp; /^(JPG|PNG|GIF|jpg|png|jpeg|gif)$/.test(ext))){ 
                               // extension is not allowed 
                               status.text('Only JPG, PNG or GIF files are allowed');
                               return false;
                            }
                            jQuery('#&lt;?php echo ($value['id']); ?&gt;loader').addClass('activeload');
                        },
                        onComplete: function(file, response){
                            //On completion clear the status
                            status.text('');
                            //Successful upload
                            if(response==="success"){
                                $file = file.toLowerCase().replace(/ /g,'_').replace(/(_)\1+/g, '_').replace(/[^\w\(\).-]/gi,'_').replace(/__/g,'_').replace(/#/g, '_');
                                //Preview uploaded file
                                jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').removeClass('uploaderror');
                                jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').html('&lt;img class="preview" src="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'" alt="&lt;?php echo ($value['id']); ?&gt; Image" /&gt;').addClass('success');
                                //Add image source to hidden input
                                jQuery('input#&lt;?php echo ($value['id']); ?&gt;').attr('value', '&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file);
                                //Append thumbnail to gallery
                                jQuery('.thumbs').append('&lt;a class="preview" href="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'"&gt;&lt;img src="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'" /&gt;&lt;/a&gt;');
                                //Save Me Fool
                                activate_save_animation();
                            } else{
                                //Something went wrong
                                jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').text(file+' did not upload. Please try again.').addClass('uploaderror');
                            }
                            jQuery('#&lt;?php echo ($value['id']); ?&gt;loader').removeClass('activeload');
                        }
                    });
</code></pre>

<p>and the code content base64_decode is like this:</p>

<pre><code> &lt;?php
 //Upload Security
 $upload_security = md5($_SERVER['SERVER_ADDR']);
 $uploaddir = base64_decode( $_REQUEST['upload_path'] ) . "/";
 if( $_FILES[$upload_security] ):
 $file = $_FILES[$upload_security];
$file = $uploaddir . strtolower(str_replace('__', '_', str_replace('#', '_', str_replace(' ', '_', basename($file['name'])))));
    if (move_uploaded_file( $_FILES[$upload_security]['tmp_name'], $file)):
        if(chmod($file,0777)):
            echo "success"; 
        else:
            echo "error".$_FILES[$upload_security]['tmp_name'];
        endif;
    else:
        echo "error".$_FILES[$upload_security]['tmp_name'];
    endif;
 endif;
 ?&gt; 
</code></pre>

<p>Would really appreciate your help.</p>

<p>Thank you.</p>