The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
24 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
1answer
23 views

Post text sanitization after publishing/editing - changes are not saved

I'm developing a simple plugin that does additional processing on post text when user saves/updates the post (i.e. clicks Publish post or Update post button). function ...
1
vote
1answer
23 views

Do we have to santise html passing into Javascript ? How?

I am passing a <ul><li></li><ul> to jquery .html() method and it works. I am assigning the html to a varaible and passing to .html() method . As some security scans suggest ...
0
votes
0answers
34 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
1answer
59 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
0
votes
0answers
33 views

Sanitize Term Custom Field - apostrophe problem

Alright guys, before posting I've searched the similar questions but I couldn't find the answer. Problem: I've added custom fields to a custom taxonomy, when I'm saving the options using ...
0
votes
1answer
42 views

Trouble creating custom sanitization function when uploading video files

I'm trying to create a Theme Customizer control in Wordpress that will allow the user to upload an MP4 and WEBM video, and in doing so I need to create a sanitization option to verify the file type. ...
3
votes
1answer
160 views

Make shortcode work with nested double quotes

I have following shortcode: function infobox_shortcode( $atts, $content = null ) { extract( shortcode_atts( array( 'src' => '', 'title' => '', 'text' => '', ), ...
2
votes
1answer
394 views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
0
votes
0answers
146 views

WordPress theme options settings not saving

I have problem with my theme options settings saving. My settings is to saving to permanently , its just only save when you stay on the theme options page after saving the settings. But when I go to ...
1
vote
1answer
375 views

How to safely sanitize a textarea which takes full HTML input

I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags ...
0
votes
4answers
56 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
2answers
206 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...
0
votes
1answer
50 views

Custom-Metaboxes-and-Fields text_url field prepending http://

I'm using the Custom Metaboxes and Fields code wich is pretty good. However I need sanitization on URL fields of course but the built in text_url field type is adding 'http://' to my entries. I know ...
0
votes
0answers
60 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
1answer
104 views

I'm confused about url sanitization in meta boxes

I'm making meta box for a custom post. This meta box will contain a href value. I dont need any validation that is it valid href value but i would like to do this in a way that it is secure. I have ...
1
vote
1answer
28 views

Sanitize Disqus API results?

Can I trust the results from the Disqus API, not to include evil scripts? Can I find information somewhere. Would you sanitize the JSON data, that is returned? Official answers?
0
votes
0answers
94 views

Percent-encoded slug appears as decoded

What is the WordPress mechanism for creating post slugs when creating a new draft? I enter a post title, and after some seconds, a suggested permalink appears. I have traced this behaviour to the ...
1
vote
1answer
143 views

Getting error to display radio button value in General Settings page

I'm constantly getting the errors bellow when printing the radio button values from General Settings screen: Illegal string offset 'service' in ...
0
votes
1answer
58 views

Toggle Shortcode Sanitize Title

Wondering if anyone can help me out... here is my custom theme shortcode: add_shortcode('toggle', 'shortcode_toggle'); function shortcode_toggle( $atts, $content = null ) { ...
0
votes
1answer
79 views

data-type=“” … needed post tags stripped of characters

So I am trying to generate a list of post tags on the data-type attribute but I need them to be sanitized so spaces are replaced with underscores and there are no special characters... really ...
3
votes
1answer
129 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
3answers
434 views

How do I sanitize a javascript text?

I have a textarea that will receive a js snippet(Google Analytics). Is there a way to sanitize that? Since I cannot use functions like wp_filter_nohtml_kse(), what should I use?
0
votes
1answer
43 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** ...
0
votes
1answer
48 views

Output Sanitation

I've read the WP codex and several tutorials about data validation and sanitation in WordPress. Now I've got this simple example code: $title = "<script>alert('Test')</script>"; echo ...
2
votes
2answers
842 views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
0
votes
0answers
83 views

Wordpress post saves until Apostrophe (’) is used

I've installed wordpress onto a fresh VPS with nginx + php-fpm, the installation works fine apart from whenever I post something with a ’ the post ends there. It's looks to be some sort of escape ...
0
votes
1answer
175 views

Change filename during upload

I check the below answer to rename files during upload and tries to change it to something like postid_originalfilename.jpg but failed. Any help? function make_filename_hash($filename) { $info = ...
0
votes
3answers
1k views

Escaping quotes from shortcode attributes

I have been trying to figure out how to escape quotes (single and double) from shortcode attributes. Basically the content is written by the user and therefore can potentially include " and ' quotes. ...
0
votes
1answer
238 views

Notice: Undefined index: in options-framework.php

I am generating the following notice in the options-framework.php. Notice: Undefined index: in options-framework.php I believe it is something to do with sanitization, but do not know how to resolve ...
1
vote
2answers
157 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
0
votes
1answer
53 views

Sanitizing a custom query's clauses

I'm trying to build a custom query much like the one found in WordPress' native get_posts() inside wp-includes/query.php, meaning something along these lines: global $wpdb SELECT * FROM ...
0
votes
1answer
92 views

Invalidate username if it contains @ symbol

I would like to let the user login either using username or email. The only way to find the email is by detecting @ symbol using strpos. However WordPress allow @ symbol in username too. Can ...
1
vote
0answers
74 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
3answers
1k views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
0
votes
1answer
411 views

wp_sanitize_redirect strips out @ signs (even from parameters) — why?

In my wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to ...
1
vote
1answer
469 views

How to sanitize uploaded file filename from a plugin?

There is a problem with WordPress Form Manager plugin that doesn't sanitize the uploaded file filename. So, when a user upload a photo with special characters in the filename, you will not be able to ...
1
vote
2answers
1k views

<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security

Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes. According to the above ...
3
votes
2answers
474 views

Sanitize User Entered CSS

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like ...
5
votes
2answers
1k views

Settings API - sanitizing urls, email addresses and text

I am asking for advice on best practices on how to write this code. Currently I have simple theme options with text fields, outputting the info in my template. I am currently using this code for the ...
3
votes
1answer
276 views

Sanitation needed for WP_Query or get_posts calls?

Just wanted to get a straight answer on this: when submitting query_vars to a call to get_posts or WP_Query, is sanitation needed or does WordPress already take care of that?
2
votes
1answer
123 views

Sanitising post content for use in an email

I'm sending the content of a custom post type in a plaintext email (it's to send competition entries to a panel of judges), so I need to make sure that $post->post_content is correctly sanitised ...
1
vote
1answer
799 views

Sanitizing search data for use with WP_Query

I'm using heavily-customised WordPress to drive a fishkeeping website. I have two separate search areas: a site-wide search and a fish species search. The latter also has advanced search features ...
3
votes
1answer
339 views

Sanitatizing when using the posts_where hook

I am altering the WordPress query, using the posts_where hook, when a (custom) query variable is set as follows: add_filter('posts_where', 'my_posts_where' ); function my_posts_where( $where ){ ...
2
votes
2answers
805 views

wordpress sanitize array?

I have a custom post form that sends data to a page which uses wp_insert_post to create a post. I can easily sanitize most data, but I have some troubles with my tags, I retrieve in an array: $tags = ...
9
votes
1answer
547 views

How safe / sanitized is wp_insert_posts()?

Looking at the Codex for wp_insert_post() it states that this function "...sanitizes variables, does some checks, fills in missing variables like date/time, etc. " (EDIT: I updated the Codex entry to ...
9
votes
1answer
5k views

Is sanitize_title enough to generate post slugs?

I want to generate slug for some strings without going through WordPress slug generation flow. Therefore, I want to know which functions it calls to get a neat slug. I tried sanitize_title() but it ...
6
votes
1answer
403 views

Which KSES should be used and when?

The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes." On the other hand, wp_kses_data is passed data that's "expected to not be ...
1
vote
2answers
2k views

why is esc_html() returning nothing given a string containing a high-bit character?

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
4
votes
3answers
497 views

Reason for Lowercase usernames

I can see validate_user() calls sanitize_user() with strict argument as true, which means uppercase letters are not allowed too. In source code, I found this comment // If strict, reduce to ASCII ...