THANK YOU for the additional security info.

But, one more thing…

How do you prevent it from happening in the first place?

Do you just validate your incoming (form?) data by (1)parsing strings for evil commands and (2)checking to make sure that data comes from your site and not a fake page set up by a hacker? (There must be a PHP environment variable that can tell you what page a form’s data was submitted from, right?)

Or are hackers somehow just exploiting WordPress security holes?

Regards,
Johnny