A strange and solution to the escape character of WordPress

A few days ago, there is a fishing teacher to the scene for a friend to solve a website registration verification problem. The problem is this: after the friend's website is registered with the mailbox, the system will send an email to the mailbox, and then click the link to set the initial password of the account. As shown in the following:

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/89/AA/wKiom1gZYjOxwH9VAAA2rWL6tT4931.png "title=" 20161031.1.png "alt=" Wkiom1gzyjoxwh9vaaa2rwl6tt4931.png "/>

But after I click on this link, WordPress has been prompted invalid key, that is, key error. Because it is the WordPress framework, from the URL of the route to see, I will open wp-login.php, and then look at the action Rp. I intuitively feel that the key in the get URL is not equal to the key value in the database. So, want to enter the system of MySQL a check exactly, but unfortunately there is no MySQL permissions, I do not know his site is to let who do, is estimated to be a outsourcing it. Because friends do not know the technology, a lot of things ask him is also ask Sanbuzhi. There is no way to do it yourself.

Foreign affairs do not decide to ask Google, inside the matter do not ask Baidu. I habitually open Baidu, enter: WordPress New user Registration key is invalid. Find a lot of peers with similar problems, and see how they are solved? Their advice is to:

Edit the pluggable.php file in the Wp-includes folder to remove the > in the variable $message. I did it, and I found it was still not working. So, many of the things on the internet have to be practiced by themselves, otherwise they are to be pits. But in this step, I'm more convinced that the value of key is faulty. Then I carefully read the email sent over the link, found that the link has a problem.

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/89/A7/wKioL1gZYmbSUKaCAABMdLpXdPA952.png "title=" 20161031.2.png "alt=" Wkiol1gzymbsukacaabmdlpxdpa952.png "/>

The & in this link is the value after the & is escaped. So what happens when I type & in a browser and replace it with &? Found OK, then the password reset succeeded. In this way, the problem is good to do, in theory, I just modify the pluggable.php, & to replace the & on it. The $message variables are assigned the following values:

$message. = ' < '. Network_site_url ("wp-login.php?action=rp&key= $key &login=". Rawurlencode ($user->user_login), ' login '). ">\r\n\r\n";

But the problem is, I do not use Htmlspecialchars_decode ($message) processing, with Str_replace ("&amp;", "&", $message) processing is not possible. In other words, this &amp; substitution is not &.

I look at the $message variable again, the & behind the RP is not escaped, and the & behind the $key is escaped. So, at this point, I wonder if there is a problem with the order of the statements? Then I put the &key= $key behind ($user->user_login). Then, according to the previous Baidu's comments, by the way < and > meet also removed. Thus, the revised message is as follows:

$message. = Network_site_url ("wp-login.php?action=rp&login=". Rawurlencode ($user->user_login). " &key= $key ", ' Login '). "\r\n\r\n";

The problem is solved.

Summary: 1, there are problems, ask Baidu generally can find some suggestions. But these suggestions are not necessarily entirely correct, and they have to be modified according to the actual situation. Some of the special symbols of 2,html, which need to be escaped before the database is stored, need to be converted back after the database is removed, which is also an important point of knowledge.

This article is from the "Programming Art" blog, so be sure to keep this source http://itsart.blog.51cto.com/1005243/1868404

A strange and solution to the escape character of WordPress