The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
47 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...
0
votes
0answers
22 views

How to handle complex data with Settings API

I hope my question isn't out of the scope of this website and that someone can help me with it. I'm currently studying the WP Settings API and I'm wondering how to create a form management section ...
0
votes
0answers
117 views

When using TinyMCE which function should i use to sanitize the data?

I am developing a theme with several custom post types and each custom post type has its own settings page added with [add_submenu_page(...)][1]. One of these submenu pages includes a tinyMCE rich ...
1
vote
1answer
190 views

How to sanitize user input?

What is the correct way sanitizing form data before submitting to the database? I have the following text input: <form method="post" action="options.php"> <?php ...
0
votes
0answers
36 views

sanatize text string

am I right to use sanitize_text_field() for every echo of a variable? I'm trying to get my code to pass the wordpress coding standards and according to docs this seems to be the proper way to ...
3
votes
1answer
66 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
0
votes
1answer
37 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** ...
0
votes
1answer
99 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
0answers
20 views

What data sanitzation function should be used to store entire source code of webpage?

What is the best data santization function to use when the entire source code of a webpage (head, body elements, etc) are going to be stored in a post meta field? In other words, which function will ...
2
votes
2answers
516 views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
0
votes
0answers
140 views

Manipulating Contact Form 7 POST data

Contact Form 7 strips <> HTML brackets from text and textarea fields. I'd like to be able to replace them with their proper HTML entity counterparts, &lt; and &gt;. I cannot figure out ...
0
votes
1answer
174 views

wordpress is adding a second backslash when I use addslashes

I don't know why but it seems like wordpress is adding a second backslash when I'm using the following functions: addslashes($str_with_single_quotes) ...
1
vote
1answer
136 views

Escaping date string in url with wordpress

I am creating a Wordpress page that searches through posts based on a date variable that is set through a _GET variable. I want to make sure that I am doing this in the best way possible and that I ...
0
votes
1answer
880 views

How to use checked() function with multiple check box group? How to properly sanitize that checkbox group?

I'm using the theme options page from the underscores (_s) theme to build a theme options page and I have a group of check boxes on it. In the example below I've just included 2 for simplicity. My ...
2
votes
1answer
236 views

WP doesn't show Array Custom Fields?

I'm wondering why WordPress doesn't list PHP array() and any serialized data in Custom Fields in Admin Panel (for Pages, Posts etc.)? Only Custom Fields containing strings and numbers show up and can ...
14
votes
2answers
446 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
3
votes
1answer
725 views

Default Wordpress settings API data sanitization

It looks to me that when saving data to the database via the settings API Wordpress sanitizes data by default. By that I mean that if I look at the raw settings options in the database they have (at ...
1
vote
1answer
119 views

How to get rid of shortcodes in post content once and for all

I changed theme/plugin now the post content still display shortcodes. There are some tips around on hiding them, but everytime I use some content functions, the shortcodes shows up again. Also, my ...
0
votes
2answers
7k views

How to display data from custom table in wordpress database?

I want to retrieve data from custom table, that I've made inside the wordpress database and display it in a wordpress page , like posts Thanks in advance
7
votes
2answers
2k views

Data sanitization: Best Practices with code examples

I am trying to understand data sanitization (not data validation) to help me write secure themes for WordPress. I have searched the Internet trying to find a comprehnsive guide for theme developers ...
3
votes
1answer
216 views

Sanitation needed for WP_Query or get_posts calls?

Just wanted to get a straight answer on this: when submitting query_vars to a call to get_posts or WP_Query, is sanitation needed or does WordPress already take care of that?
0
votes
1answer
89 views

settings api and the data passed in the parameter

in an example of the Settings API, there's an input and the callback function to sanitize/validate the result from this input : this is the input : echo "<input id='text_string' ...
0
votes
1answer
117 views

Data validation for inline javascript

I try to save inline javascript(Google analytics code) in wp-options table. But i can't figure out what validation function i shall use. I have tried esc_js when saving to the database. But i can't ...
3
votes
1answer
742 views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
1answer
134 views

Contact Form Security

Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
6
votes
1answer
576 views

What is the difference between esc_html and wp_filter_nohtml_kses?

What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
7
votes
2answers
1k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., ...
1
vote
1answer
555 views

Data sanitization for user registration and user login

What kinds of data sanitization I have to do if I make a front end login and registration system for wordpress users? For login function wp_signon() should I escape the data for possible sql ...
3
votes
1answer
600 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...