The tag has no wiki summary.

learn more… | top users | synonyms (1)

0
votes
1answer
17 views

Trouble creating custom sanitization function for user list dropdown

I'm trying to create a custom author info box on homepage which will automaically generate by getting the info from user profile when a user is selected from theme customizer. I followed the code ...
0
votes
1answer
40 views

WP_Editor - Saving Value into Plugin Option - Stripping HTML

I have a wp_editor(); on my plugin settings page. I also have enabled the "Font Size" drop down in TinyMCE. After highlighting text in the wp_editor(); and selecting a font size from the editor's ...
0
votes
0answers
34 views

Sanitize html, where to sanitize

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code: functions.php function zz_style($properties, $values) { $styles_array = array(); ...
9
votes
3answers
866 views

Should I sanitize an email address before passing it to the is_email() function?

I'm using is_email() to check if a user-provided email address is valid. For example: $email = $_POST['email']; if ( is_email( $email ) ) // Do something. To the best of my knowledge, nothing ...
1
vote
2answers
30 views

sanitizing integer input for update_post_meta

When updating a post meta where the input will be always an integer, should i use (int) or is there any WordPress function for that (eg. sanitize_text_field) For example ...
1
vote
0answers
12 views

Multiple register settings, with same option name - issue

I already posted this question in wordpress support forums here but I didn't get any help and nor could I find a solution yet. As the title says, I am calling register_settings functions multiple ...
0
votes
1answer
41 views

How does Wordpress store data?

I have looked inside Wordpress database. Example: In wp_options table, option_name column, active_plugins row, its option_value is ...
4
votes
1answer
66 views

What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?

Taken from the articles referenced below: wp_strip_all_tags() "Properly strip all HTML tags including script and style." wp_filter_nohtml_kses() "Strips all of the HTML in the content." Ref: ...
0
votes
1answer
78 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
1answer
24 views

Post text sanitization after publishing/editing - changes are not saved

I'm developing a simple plugin that does additional processing on post text when user saves/updates the post (i.e. clicks Publish post or Update post button). function ...
0
votes
1answer
148 views

Safely store code(html/js..) into database

So I'm working on a small plugin, and this plugin allows users to save data to my db. This data is mostly plain text but 3 fields are will have tags inside them. 1 field can be used to save all kind ...
0
votes
1answer
51 views

Save selectlist value (taxonomy) in wp:wp_set_object_terms

In my admin for part i have additional fields (like price or brand - which is taxonomy). When i edit or create new part, i set up additional data. and price saving is without any problem, but saving ...
1
vote
1answer
82 views

Do we have to santise html passing into Javascript ? How?

I am passing a <ul><li></li><ul> to jquery .html() method and it works. I am assigning the html to a varaible and passing to .html() method . As some security scans suggest ...
0
votes
0answers
58 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
1answer
79 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
0
votes
0answers
63 views

Sanitize Term Custom Field - apostrophe problem

Alright guys, before posting I've searched the similar questions but I couldn't find the answer. Problem: I've added custom fields to a custom taxonomy, when I'm saving the options using ...
0
votes
1answer
76 views

Trouble creating custom sanitization function when uploading video files

I'm trying to create a Theme Customizer control in Wordpress that will allow the user to upload an MP4 and WEBM video, and in doing so I need to create a sanitization option to verify the file type. ...
3
votes
1answer
249 views

Make shortcode work with nested double quotes

I have following shortcode: function infobox_shortcode( $atts, $content = null ) { extract( shortcode_atts( array( 'src' => '', 'title' => '', 'text' => '', ), ...
2
votes
1answer
739 views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
0
votes
0answers
168 views

WordPress theme options settings not saving

I have problem with my theme options settings saving. My settings is to saving to permanently , its just only save when you stay on the theme options page after saving the settings. But when I go to ...
1
vote
1answer
483 views

How to safely sanitize a textarea which takes full HTML input

I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags ...
0
votes
4answers
76 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
2answers
299 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...
0
votes
1answer
58 views

Custom-Metaboxes-and-Fields text_url field prepending http://

I'm using the Custom Metaboxes and Fields code wich is pretty good. However I need sanitization on URL fields of course but the built in text_url field type is adding 'http://' to my entries. I know ...
0
votes
0answers
34 views

How to handle complex data with Settings API

I hope my question isn't out of the scope of this website and that someone can help me with it. I'm currently studying the WP Settings API and I'm wondering how to create a form management section ...
0
votes
0answers
79 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
1answer
125 views

I'm confused about url sanitization in meta boxes

I'm making meta box for a custom post. This meta box will contain a href value. I dont need any validation that is it valid href value but i would like to do this in a way that it is secure. I have ...
1
vote
1answer
29 views

Sanitize Disqus API results?

Can I trust the results from the Disqus API, not to include evil scripts? Can I find information somewhere. Would you sanitize the JSON data, that is returned? Official answers?
1
vote
1answer
169 views

Getting error to display radio button value in General Settings page

I'm constantly getting the errors bellow when printing the radio button values from General Settings screen: Illegal string offset 'service' in ...
1
vote
1answer
523 views

How to sanitize user input?

What is the correct way sanitizing form data before submitting to the database? I have the following text input: <form method="post" action="options.php"> <?php ...
0
votes
1answer
59 views

Toggle Shortcode Sanitize Title

Wondering if anyone can help me out... here is my custom theme shortcode: add_shortcode('toggle', 'shortcode_toggle'); function shortcode_toggle( $atts, $content = null ) { ...
0
votes
1answer
84 views

data-type=“” … needed post tags stripped of characters

So I am trying to generate a list of post tags on the data-type attribute but I need them to be sanitized so spaces are replaced with underscores and there are no special characters... really ...
3
votes
1answer
169 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
3answers
487 views

How do I sanitize a javascript text?

I have a textarea that will receive a js snippet(Google Analytics). Is there a way to sanitize that? Since I cannot use functions like wp_filter_nohtml_kse(), what should I use?
0
votes
1answer
47 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** ...
0
votes
1answer
168 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
1answer
55 views

Output Sanitation

I've read the WP codex and several tutorials about data validation and sanitation in WordPress. Now I've got this simple example code: $title = "<script>alert('Test')</script>"; echo ...
0
votes
0answers
22 views

What data sanitzation function should be used to store entire source code of webpage?

What is the best data santization function to use when the entire source code of a webpage (head, body elements, etc) are going to be stored in a post meta field? In other words, which function will ...
2
votes
2answers
1k views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
0
votes
0answers
93 views

Wordpress post saves until Apostrophe (’) is used

I've installed wordpress onto a fresh VPS with nginx + php-fpm, the installation works fine apart from whenever I post something with a ’ the post ends there. It's looks to be some sort of escape ...
0
votes
1answer
227 views

Change filename during upload

I check the below answer to rename files during upload and tries to change it to something like postid_originalfilename.jpg but failed. Any help? function make_filename_hash($filename) { $info = ...
1
vote
3answers
2k views

Escaping quotes from shortcode attributes

I have been trying to figure out how to escape quotes (single and double) from shortcode attributes. Basically the content is written by the user and therefore can potentially include " and ' quotes. ...
0
votes
1answer
309 views

wordpress is adding a second backslash when I use addslashes

I don't know why but it seems like wordpress is adding a second backslash when I'm using the following functions: addslashes($str_with_single_quotes) ...
0
votes
1answer
277 views

Notice: Undefined index: in options-framework.php

I am generating the following notice in the options-framework.php. Notice: Undefined index: in options-framework.php I believe it is something to do with sanitization, but do not know how to resolve ...
1
vote
2answers
168 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
0
votes
1answer
54 views

Sanitizing a custom query's clauses

I'm trying to build a custom query much like the one found in WordPress' native get_posts() inside wp-includes/query.php, meaning something along these lines: global $wpdb SELECT * FROM ...
0
votes
1answer
99 views

Invalidate username if it contains @ symbol

I would like to let the user login either using username or email. The only way to find the email is by detecting @ symbol using strpos. However WordPress allow @ symbol in username too. Can ...
1
vote
1answer
176 views

Escaping date string in url with wordpress

I am creating a Wordpress page that searches through posts based on a date variable that is set through a _GET variable. I want to make sure that I am doing this in the best way possible and that I ...
0
votes
1answer
2k views

How to use checked() function with multiple check box group? How to properly sanitize that checkbox group?

I'm using the theme options page from the underscores (_s) theme to build a theme options page and I have a group of check boxes on it. In the example below I've just included 2 for simplicity. My ...
2
votes
1answer
270 views

WP doesn't show Array Custom Fields?

I'm wondering why WordPress doesn't list PHP array() and any serialized data in Custom Fields in Admin Panel (for Pages, Posts etc.)? Only Custom Fields containing strings and numbers show up and can ...