Data Validation, dynamically generated fields (select for example)

Question

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP which is 200+ options long, but is stored - in its entirety - simply as $ctry_code_sel. Of course, I get the sentiment that "Everything is Suspect", and I get using wordpress's native esc_url and esc_attr_e etc. in response, but it seems that esc_html_e et.al. are of no use in cases such as this.

When the time comes - on any given page - that I want to output my select field (e.g echo $ctry_code_sel;) is there something I can/should be doing there to guard against cross-site-scripting attack etc.?

Answer 1

As long as you do not allow anyone to edit/add new countries to your list I don't see any problems. The content of $ctry_code_sel is only controlled/modified by you.

If, on the other hand, you allow users to modify any data you use to generate the select, you should use escaping methods directly during generation, not after the HTML for the select is finished.

And as you are using a country list, maybe this could also be helpful for you: https://github.com/umpirsky/country-list/