1
vote
1answer
19 views

Do we have to santise html passing into Javascript ? How?

I am passing a <ul><li></li><ul> to jquery .html() method and it works. I am assigning the html to a varaible and passing to .html() method . As some security scans suggest ...
0
votes
0answers
28 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
1answer
51 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
0
votes
0answers
27 views

Sanitize Term Custom Field - apostrophe problem

Alright guys, before posting I've searched the similar questions but I couldn't find the answer. Problem: I've added custom fields to a custom taxonomy, when I'm saving the options using ...
0
votes
2answers
164 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...
3
votes
1answer
117 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
0
votes
1answer
42 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** ...
2
votes
2answers
805 views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
3
votes
1answer
267 views

Sanitation needed for WP_Query or get_posts calls?

Just wanted to get a straight answer on this: when submitting query_vars to a call to get_posts or WP_Query, is sanitation needed or does WordPress already take care of that?