WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:

add_filter('name_save_pre', 'save_name');
function save_name($name_to_ignore) {
         global $post, $meta_box, $wpdb;

     $this_post_id = $post->ID;
         // verify nonce -- checks that the user has access
     if ( !isset($_POST['wp_nonce']) || !wp_verify_nonce( $_POST['wp_nonce'], basename(__FILE__) )) {
        return $post_id;
         if ($_POST['post_type'] == 'mytype') :
          $name1 = $_POST['term1'];
          $name2 = $_POST['term2'];
          $name3 = $_POST['custom_field_1'];
          $name4 = $_POST['custom_field_2'];
          $my_post_name = $name1."-".$name2."-".$name3."-".$name4."-".$this_post_id;
        return $my_post_name;

I just want to is it secure to save the data this way. Cause I read somewhere else (which is I forgot where), said that using $_POST['Custom_field']; is very easy to get hacked. Is it true?

share|improve this question

Validate input values and sanitize outputting data. Take a read good article about Data Sanitization and Validation With WordPress, it will make you understanding these principles better.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.