title: How to fix the base64_encode and base64_decode to avoid injection?
body: <p>I am using a theme option for WordPress with base64_encode and base64_decode. Since base64_ risk for the code injection, need to change that code.
  Actually I have no idea how to do that.</p>
  
  <p>The code contain base64_encode is like this:</p>
  
  <pre><code>                    new AjaxUpload(&lt;?php echo ($value['id']); ?&gt;, {
                          action: '&lt;?php echo THEME_DIR; ?&gt;/admin/upload-file.php',
                          name: '&lt;?php echo ($upload_security)?&gt;',
                          data: {
                              upload_path : '&lt;?php echo base64_encode(UPFW_UPLOADS_DIR); ?&gt;'
                          },
                          onSubmit: function(file, ext){
                              //Check if file is an image
                              if (! (ext &amp;&amp; /^(JPG|PNG|GIF|jpg|png|jpeg|gif)$/.test(ext))){ 
                                 // extension is not allowed 
                                 status.text('Only JPG, PNG or GIF files are allowed');
                                 return false;
                              }
                              jQuery('#&lt;?php echo ($value['id']); ?&gt;loader').addClass('activeload');
                          },
                          onComplete: function(file, response){
                              //On completion clear the status
                              status.text('');
                              //Successful upload
                              if(response==="success"){
                                  $file = file.toLowerCase().replace(/ /g,'_').replace(/(_)\1+/g, '_').replace(/[^\w\(\).-]/gi,'_').replace(/__/g,'_').replace(/#/g, '_');
                                  //Preview uploaded file
                                  jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').removeClass('uploaderror');
                                  jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').html('&lt;img class="preview" src="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'" alt="&lt;?php echo ($value['id']); ?&gt; Image" /&gt;').addClass('success');
                                  //Add image source to hidden input
                                  jQuery('input#&lt;?php echo ($value['id']); ?&gt;').attr('value', '&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file);
                                  //Append thumbnail to gallery
                                  jQuery('.thumbs').append('&lt;a class="preview" href="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'"&gt;&lt;img src="&lt;?php echo UPFW_UPLOADS_URL; ?&gt;/'+$file+'" /&gt;&lt;/a&gt;');
                                  //Save Me Fool
                                  activate_save_animation();
                              } else{
                                  //Something went wrong
                                  jQuery('#&lt;?php echo ($value['id']); ?&gt;preview').text(file+' did not upload. Please try again.').addClass('uploaderror');
                              }
                              jQuery('#&lt;?php echo ($value['id']); ?&gt;loader').removeClass('activeload');
                          }
                      });
  </code></pre>
  
  <p>and the code content base64_decode is like this:</p>
  
  <pre><code> &lt;?php
   //Upload Security
   $upload_security = md5($_SERVER['SERVER_ADDR']);
   $uploaddir = base64_decode( $_REQUEST['upload_path'] ) . "/";
   if( $_FILES[$upload_security] ):
   $file = $_FILES[$upload_security];
  $file = $uploaddir . strtolower(str_replace('__', '_', str_replace('#', '_', str_replace(' ', '_', basename($file['name'])))));
      if (move_uploaded_file( $_FILES[$upload_security]['tmp_name'], $file)):
          if(chmod($file,0777)):
              echo "success"; 
          else:
              echo "error".$_FILES[$upload_security]['tmp_name'];
          endif;
      else:
          echo "error".$_FILES[$upload_security]['tmp_name'];
      endif;
   endif;
   ?&gt; 
  </code></pre>
  
  <p>Would really appreciate your help.</p>
  
  <p>Thank you.</p>