WordPress St. Louis Developers Meetup: Security Best Practices

prepare-sql.php

<?php
global $wpdb;

// Clean SQL before running
$sql = $wpdb->prepare('SELECT * FROM ' . $wpdb->posts . ' WHERE status = %s AND post_type = %s', 'publish', 'page');

// Return results
$results = $wpdb->get_results($sql);
?>

user-permissions-check.php

<?php
// Security Checkpoint
if(!current_user_can('edit_theme_options')){
    wp_die(__('You do not have sufficient permissions to access this page.'));
}
?>