Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've read several topics about this and different ppl have different views on the best practice.

In terms of WP, how do I store data to DB the safest way?

This is one insert I'm using now:

  $result = $wpdb->insert($table_name , 
  array( 
    'arena' => $galleryData['arena'],
    'year' => substr($galleryData['season'], 2),
    'copyright' => $galleryData['copyright'],
    'description' => $galleryData['description'],
    'path' => $galleryData['path'],
    'fk_brand_id' => $galleryData['brand']
  ), 
  array( '%s', '%d', '%s', '%s', '%s', '%d' ));

Reading a book, another way of inerting data is doing this:

$sanitized_sql = $wpdb->prepare(“
  ’INSERT INTO my_plugin_table SET field1 = %1$d, field2 = %2$s, field3 = %3$s’, 32, ‘Aaron Brazell’, ‘Washington, D.C’);
$wpdb->query( $sanitized_sql );

Do I still need to sanitize data using wp_kses or mysql_real_escape_string ?

I'm just confused on what method is the better for safely storing data to DB.

I found one answer here: http://stackoverflow.com/questions/2127009/using-wordpress-can-some-one-tell-me-the-best-way-of-sanitizing-input

So should I or should I not sanitize data before input?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

No the sanitization is already done. Well the mysql_real_escape_string is done, it's considered bad form to filter html on input. I personally think doing it on output kinda breaches DRY. If you did in WordPress I highly suspect somewhere else will do it again resulting in double html entities encoding.

Also by the way, wpdb::insert is basically just a wrapper for wpdb::prepare.

share|improve this answer
    
Thanks for clearing that up. So there is no real point in using wp_kses before storing data to DB? Or any other filter found here? codex.wordpress.org/Data_Validation –  Steven Jan 29 '11 at 11:57
    
Well I guess it really depends what you're doing with the data. If you're handling it yourself completely then good form is to do it on output. –  Backie Jan 29 '11 at 12:22
add comment

Note that storing data safely is different from safe data. For example JavaScript code can be totally harmless in context of database security, but nightmare in context of front-end.

There is no single blanket approach, that is why WordPress has massive amount of related functions.

You must consider:

  1. What data is.
  2. Where it comes from.
  3. How is it going to be used.
share|improve this answer
    
Do you have any good references for point 1-3? I've seen the Data Validation page - that's what I've been using so far. But I'm still unsure of what is better practice for storing / retrieving data the safest way inputed by users. –  Steven Jan 30 '11 at 11:27
    
@Steven well, that page is quite comprehensive in context of WP. Most important point is at start - " untrusted data [..] needs to be validated both on input and output ". So you need to sanitize untrusted data when it goes to database (->prepare() and such) and when it goes to display (esc_ and such). –  Rarst Jan 30 '11 at 11:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.