Security Best Practices
Learn about security precautions while saving user generated content and reading data from the database.
We'll cover the following...
Someone may come to the site and in the body field, instead of writing a note, they might write some JavaScript code like <script>alert("Hahaha")</script> to make an alert message pop up. Now an alert is not something malicious but the idea is that if we are able to execute any JavaScript code, that is a security gap. You can execute any malicious JavaScript too.
However, when we save this note, we see that the opening and closing tags are removed by WordPress which prevents this code from actually being executed as JS. By default, WordPress only allows admin accounts to post unfiltered HTML.