Security Notes

Security considerations for wpzylos-migrations.

Migration Security

No User Input in Migrations

Migrations should never use user input:

// Bad: NEVER do this
public function up(): void
{
    $column = $_GET['column'];
    $wpdb->query("ALTER TABLE {$table} ADD {$column} VARCHAR(255)");
}

// Good: Migrations are static definitions
public function up(): void
{
    $this->runDbDelta($sql);
}

Validate Schema Changes

Before running migrations in production:

# Dry run to see changes
wp zylos migrate --dry-run

# Backup database first
wp db export backup.sql

Rollback Safety

public function down(): void
{
    // Be specific about what to remove
    $this->dropTable('orders');

    // Don't drop tables from other plugins!
}

Related

• Database Security