1
vote
1answer
16 views

Do we have to santise html passing into Javascript ? How?

I am passing a <ul><li></li><ul> to jquery .html() method and it works. I am assigning the html to a varaible and passing to .html() method . As some security scans suggest ...
0
votes
0answers
21 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
1answer
42 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
0
votes
0answers
22 views

Sanitize Term Custom Field - apostrophe problem

Alright guys, before posting I've searched the similar questions but I couldn't find the answer. Problem: I've added custom fields to a custom taxonomy, when I'm saving the options using ...
0
votes
2answers
127 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...
0
votes
0answers
42 views

sanatize text string

am I right to use sanitize_text_field() for every echo of a variable? I'm trying to get my code to pass the wordpress coding standards and according to docs this seems to be the proper way to ...
3
votes
1answer
106 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
0
votes
1answer
39 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** ...
2
votes
2answers
742 views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
3
votes
1answer
253 views

Sanitation needed for WP_Query or get_posts calls?

Just wanted to get a straight answer on this: when submitting query_vars to a call to get_posts or WP_Query, is sanitation needed or does WordPress already take care of that?