Potential Security Issues with Passing Wordpress Variable as a Parameter on get_permalink()
<p>I need to make sure I'm not opening up a security hole in my site. I have a Custom Post Type called "Communities" and a custom post type called "Floor Plans" and need to add a parameter to the URL on Single Floorplan posts.</p>

<p>My goal is that when a Floorplan post object is selected from a Communities Single post, it appends the name of the community (i.e. single community post title) to the URL for use on the following page. So, enabling query vars:</p>

<pre><code>    &lt;?php

    //* Enable queryvars (functions.php)

    add_filter('query_vars', 'parameter_queryvars' );
    function parameter_queryvars( $qvars )
    {
    $qvars[] = "community";
    return $qvars;
    }
</code></pre>

<p>I have a template part called "dynamic-floor-plans" that lives in a loop at the bottom of Single Communities posts. I'm grabbing the single_post_title of the current communities page, and passing that to the URL so that it's available using $_GET</p>

<p>The reason we opted for this method is that the "Floor Plans" post type has a canonical/default version that has the same properties as its Community-specific counterparts. In order to avoid a post relationship situation (which would give the user flat out wrong data in some cases) the community versions just have to be able to use </p>

<pre><code>  &lt;?php

  //* dynamic-floor-plans template part (placed in loop on communities page)

  global $post;
  $string = strtolower(single_post_title( null, false ));
  $slug = str_replace(' ','-',$string);
  ?&gt;

     &lt;div class="card-button"&gt;
      &lt;a class="small expanded secondary button" 
        href="&lt;?php echo get_the_permalink() . '?community=' . $slug ?&gt;"&gt;View Floorplan&lt;/a&gt;
   &lt;/div&gt;
</code></pre>

<p>Now, this totally is working. I'm able to grab that community variable on the subsequently-selected floorplan single page using $_GET and things seem to be working nicely on the front end:</p>

<pre><code>    &lt;?php
    //*  Single Floorplans Template

    $community = $_GET["community"];

    ?&gt;
      &lt;h1 class="entry-title"&gt;&lt;?php echo $title ?&gt;&lt;/h1&gt;
      &lt;h4&gt;
        &lt;?php if ($community) { ?&gt; 
          At &lt;?php echo $community; }  ?&gt;
     &lt;/h4&gt;
     ...
</code></pre>

<p>I just can't help but feel that this isn't kosher, or that there's a more secure way to do this.</p>

<p>Am I open to exploitation? I can include the function for the loop itself as well, but figure this code will be sufficient to get started in evaluation.</p>