The tag has no usage guidance.

learn more… | top users | synonyms (1)

1
vote
0answers
23 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
0
votes
1answer
23 views

What function removes apostrophes when making a slug?

I am trying to convert a post title to a slug. I used sanitize_title_with_dashes, thinking that's what WordPress uses. However, if my post title has an apostrophe in it, sanitize_title_with_dashes ...
1
vote
1answer
21 views

How to use sanitize_callback?

Theme Check is telling me add_setting() should have a sanitize_callback function so I tried to add one. This is for a color selector: $wp_customize->add_setting($setting_name, array( ...
0
votes
0answers
34 views

Sanitizing the categories input from a front end posting form

I use this solution as a development base to add a front end posting functionality to one of my Wordpress sites. I added categories to the mentioned solution, but I don't know how correctly to filter ...
1
vote
1answer
23 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
0
votes
0answers
28 views

Theme Customizier sanitize_callback not working

I have a theme option to set the slider speed. The sanitize_callback function is not working. I would like the function to set the speed to 4000ms if a non numeric character is entered. function ...
1
vote
1answer
48 views

Storing HTML in wp_options

I'm giving my users the option to store HTML in an option with a wp_editor(), using the wp settings api to handle the form. I currently do not apply any data sanatization to it, but realize I probably ...
0
votes
2answers
197 views

What's The Proper Way To SAnitize Checkbox Value Sent To The Database

I have tried using sanitize_text_field() and esc_attr() to filter checkbox data when saving their values to the database, but it is causing the data not being saved. What is causing it and what's the ...
1
vote
1answer
66 views

Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?

I'm writing a plug-in that stores UNIX datetimes in browser cookies and that also uses a $_POST variable based on a simple form that sends the ID number of the current WordPress post. After reading ...
1
vote
1answer
83 views

How to sanitize post meta field value?

I have added a meta field for text input. I want to allow some html tags such as <strong> and <i> For example: <strong>hello</strong> world I can save the input field value ...
0
votes
1answer
147 views

Remove tinyMCE from admin and replace with textarea

I have created a plugin wherein I have a custom post type. I am using post_content for some simple text. I do not need to offer any fancy editing or insertion of data for this field, so I looked for a ...
0
votes
0answers
43 views

How to sanitize an input array to save in options?

I want to santize a category IDs list before updating it, how this should be done. This is how I'm doing: $categories = get_categories(array('hide_empty'=> 0)); foreach($categories as $category) { ...
1
vote
1answer
26 views

Are all hooks/functions tied to Kses meant for sanitization?

I'm currently learning WordPress hooks and am delving into core to see what's happening in there. I noticed there are filters in wp-includes/default-filters.php with PHP comments about Kses. I wasn't ...
1
vote
1answer
68 views

Data Validation: Always escape late / escape HTML Code

I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late" I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved ...
0
votes
0answers
29 views

How do you keep WordPress from sanitizing and changing your post's format on save?

I'm setting up a blog which will make heavy use of MathJax, a JS library which renders LaTeX code into so-called "beautiful math". I'm using MathJax via the CDN rather than through JetPack because: ...
0
votes
0answers
45 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
1answer
65 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo ...
0
votes
0answers
72 views

Why are iframes from WordPress oEmbed stripped with wp_kses_post?

The docs for wp_kses_post() say "Sanitize content for allowed HTML tags for post content." iframe in general is an allowed tag, but more specifically I think it should allow tags created by WordPress ...
0
votes
0answers
187 views

sanitize_text_field and apostrophe problem

I've written a custom plugin to send data via a form to a personal database, different from the WP one. Everything is working fine except the fact that when you write a name, for example D'ALESSANDRO, ...
0
votes
0answers
69 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
1
vote
0answers
28 views

Change wp_sanitize function?

I have a domain name like s├ęp. wp_sanitize functions clears the ├ęcharacter. I would like to change it, but I cannot redeclare in functions.php. Is it possible to change, or WordPress cannot run ...
3
votes
1answer
515 views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
0
votes
1answer
73 views

Sanitization html output itself

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a ...
0
votes
1answer
52 views

Comparing pre-saved post_title to post-saved post_title

I'm implementing an inventory updater on a Wordpress product site that integrates with a 3rd-party website via their custom api. We're going to have a number of people updating the 3rd-party website, ...
0
votes
1answer
272 views

Can A Post Meta Field Store multiple values that are not in an array?

I have a post_meta field that seems to be displaying multiple values, yet they do not seem to be in an array. Using debug bar, this is what I see inside of the ...
0
votes
1answer
64 views

Why the WP Core team does not allow filter_* functions? [closed]

This question is somehow related to this other question. Provided that is seems we have a solution for the magic quotes issues, why the WP Core team does not allow them? This is unclear to me and I ...
0
votes
1answer
183 views

esc_attr on get_post_meta [closed]

Simple question, I see that some themes are using esc_attr or esc_html and url after they define varible with get_post_meta, while others are using it during variable definition. What would be best ...
0
votes
2answers
916 views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
0answers
88 views

How to disable special character sanitizing for slugs

We are trying to track specific blog posts that are shared on social media sites and tech blogs. I selected Google Analytics for this and using Google UTM URL builder, I created a custom campaign ...
0
votes
1answer
75 views

Using esc_url_raw with protocols properly

I'm trying to build up my own function to sanitize a URL before saving it to my WP database. However I cannot get esc_url_raw to trigger against unwanted protocols. The function below is letting all ...
0
votes
1answer
68 views

Filter string like a slug

I have a WordPress site using pretty permalinks. I want to filter a string to that the it ends up with the exact same formatting as the url slug, does anyone know the filter or function to do so?
0
votes
1answer
206 views

Trouble creating custom sanitization function for user list dropdown

I'm trying to create a custom author info box on homepage which will automaically generate by getting the info from user profile when a user is selected from theme customizer. I followed the code ...
1
vote
1answer
454 views

WP_Editor - Saving Value into Plugin Option - Stripping HTML

I have a wp_editor(); on my plugin settings page. I also have enabled the "Font Size" drop down in TinyMCE. After highlighting text in the wp_editor(); and selecting a font size from the editor's ...
0
votes
0answers
88 views

Sanitize html, where to sanitize

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code: functions.php function zz_style($properties, $values) { $styles_array = array(); ...
11
votes
3answers
1k views

Should I sanitize an email address before passing it to the is_email() function?

I'm using is_email() to check if a user-provided email address is valid. For example: $email = $_POST['email']; if ( is_email( $email ) ) // Do something. To the best of my knowledge, nothing ...
1
vote
2answers
266 views

sanitizing integer input for update_post_meta

When updating a post meta where the input will be always an integer, should i use (int) or is there any WordPress function for that (eg. sanitize_text_field) For example ...
1
vote
0answers
47 views

Multiple register settings, with same option name - issue

I already posted this question in wordpress support forums here but I didn't get any help and nor could I find a solution yet. As the title says, I am calling register_settings functions multiple ...
0
votes
3answers
1k views

Sanitize textarea instead of input

I want to add a new field to the user registration. I'm using this tutorial by Paul Underwood. The tutorial works but I want to switch the input text to a textarea which I do know how to do. The ...
0
votes
1answer
172 views

How does Wordpress store data?

I have looked inside Wordpress database. Example: In wp_options table, option_name column, active_plugins row, its option_value is ...
4
votes
1answer
639 views

What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?

Taken from the articles referenced below: wp_strip_all_tags() "Properly strip all HTML tags including script and style." wp_filter_nohtml_kses() "Strips all of the HTML in the content." Ref: ...
0
votes
1answer
483 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
1answer
37 views

Post text sanitization after publishing/editing - changes are not saved

I'm developing a simple plugin that does additional processing on post text when user saves/updates the post (i.e. clicks Publish post or Update post button). function ...
0
votes
1answer
547 views

Safely store code(html/js..) into database

So I'm working on a small plugin, and this plugin allows users to save data to my db. This data is mostly plain text but 3 fields are will have tags inside them. 1 field can be used to save all kind ...
0
votes
1answer
118 views

Save selectlist value (taxonomy) in wp:wp_set_object_terms

In my admin for part i have additional fields (like price or brand - which is taxonomy). When i edit or create new part, i set up additional data. and price saving is without any problem, but saving ...
1
vote
1answer
333 views

Do we have to santise html passing into Javascript ? How?

I am passing a <ul><li></li><ul> to jquery .html() method and it works. I am assigning the html to a varaible and passing to .html() method . As some security scans suggest ...
2
votes
0answers
334 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
1answer
253 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
0
votes
1answer
140 views

Trouble creating custom sanitization function when uploading video files

I'm trying to create a Theme Customizer control in Wordpress that will allow the user to upload an MP4 and WEBM video, and in doing so I need to create a sanitization option to verify the file type. ...
4
votes
1answer
686 views

Make shortcode work with nested double quotes

I have following shortcode: function infobox_shortcode( $atts, $content = null ) { extract( shortcode_atts( array( 'src' => '', 'title' => '', 'text' => '', ), ...
5
votes
1answer
3k views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?