WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/spark451inc/wp-spark451-simple-get-html/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

A lightweight WordPress plugin that lets you display values from URL query parameters directly in your posts, pages, or templates — with shortcodes.

Perfect for personalization, dynamic content, and quick campaign landing pages.


🚀 Installation

  1. Download & Upload

    • Clone or download this repo as a ZIP.
    • Go to WordPress Admin → Plugins → Add New → Upload Plugin.
    • Select the ZIP and click Install Now, then Activate.
  2. Composer

    Because this package is hosted on GitHub (not Packagist), you need to add the repository to your project's composer.json file:

     "repositories": [
       {
         "type": "vcs",
         "url": "https://github.com/spark451inc/wp-spark451-simple-get-html"
       }
     ]

    Then run:

     composer require spark451inc/wp-spark451-simple-get-html

🧩 Usage

This plugin provides two shortcodes for displaying $_GET parameters:


1️⃣ Single Value – [spark451_get_html_item]

Outputs a single sanitized value from the query string.

Example:

URL: https://example.com/landing-page/?bee=BuzzBuzz

Shortcode: [spark451_get_html_item bee]

Output: BuzzBuzz

✅ The value is fully sanitized and escaped before display.


2️⃣ Multiple Values – [spark451_get_html_items]...[/spark451_get_html_items]

Lets you use multiple keys and dynamically inject them into custom HTML using {{placeholders}}.

Example:

URL: https://example.com/landing-page/?bee=BuzzBuzz&honey=Sweet

Shortcode:

[spark451_get_html_items bee honey]
<div class="card">
  <h1>{{bee}}</h1>
  <p>{{honey}}</p>
</div>
[/spark451_get_html_items]

or

[spark451_get_html_items keys="bee,honey,left,right"]
<div class="card">
    <h1>{{bee}}</h1>
    <p>{{honey}}</p>
</div>
[/spark451_get_html_items]

Output:

<div class="card">
  <h1>BuzzBuzz</h1>
  <p>Sweet</p>
</div>
  • Missing query params are replaced with empty strings.
  • You can add as many keys as you want in the opening tag.

🧠 Conditional Logic & Fallbacks

✅ Fallback for single values

If a query parameter doesn’t exist, you can define fallback text or HTML using the fallback attribute.

[spark451_get_html_item key="first-name" fallback="<p>Welcome to Mississippi College!</p>"]
  • If ?first-name=John → outputs John
  • If missing → outputs <p>Welcome to Mississippi College!</p>

You can also mark required keys inline with a ! or * prefix:

[spark451_get_html_items !first_name guid fallback="<h2>Welcome!</h2>"]
  <h2>Hi {{first_name}}!</h2>
[/spark451_get_html_items]

🛡️ Security

  • All values are sanitized with sanitize_text_field().
  • Output is escaped with esc_html() before display.
  • Array-style query params are joined into a single space-separated string.
  • No raw HTML from the query string is ever rendered (safe by default).

🆕 Automatic Updates

This plugin includes a GitHub update checker.
When installed from the GitHub repository, you will receive update notifications right in your WordPress admin panel.


✅ Requirements

  • WordPress 5.8+
  • PHP 7.4+

👨‍💻 Author

Spark451 – Creative & Marketing Technology

Changelog

1.0.4

  • Add composer.json for Composer support

1.0.3

  • Add fallback and conditional

1.0.2

  • Update of description

1.0.1

  • Update of readme
  • Test auto update

Releases

4 releases.

Tag
Published
1.0.4 latest
Feb 17, 2026 8mo ago
Oct 7, 2025 1 year ago
Sep 26, 2025 1 year ago
Sep 26, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Spark451 - Simple GET HTML 1.0.4 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.4
Findings
1
Worst severity
medium
Content hash
440105311f4edc8a7ac21e52…

Findings

  • medium do_shortcode on content after injecting attacker-controlled GET values

    unsafe_input

    render_get_html_items substitutes sanitized-but-bracket-preserving GET values into shortcode body tokens, then runs do_shortcode() on the result. An unauthenticated visitor can supply query values containing [other_shortcode ...] when a page embeds spark451_get_html_items, causing nested shortcode execution (reflected shortcode injection). esc_html does not neutralise shortcode delimiters.

    wp-spark451-simple-get-html.php:231-254

    Recommendation

    Do not pass attacker-influenced strings through do_shortcode. Apply do_shortcode to the original content before substitution, or strip shortcode-like patterns from GET values before replacement.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.