Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

learn more… | top users | synonyms (1)

1
vote
1answer
342 views

I'm confused about URL sanitization in meta boxes

I'm making a meta box for a custom post and this meta box will contain a href value. I don't need any validation as this is a valid href value but I would like to do this in a way that's secure. I ...
0
votes
2answers
23k views

How to display data from custom table in wordpress database?

I want to retrieve data from custom table, that I've made inside the wordpress database and display it in a wordpress page , like posts Thanks in advance
0
votes
0answers
7 views

Getting wp_kses_post to handle protocol relative image src urls that include a port number

When I run the string: '<img src="//example.com:3000/images/emoji/emoji_one/expressionless.png" >' through wp_kses_post() it returns: '<img src="3000/images/emoji/emoji_one/expressionless....
5
votes
1answer
67 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
1
vote
1answer
35 views

Importing JSON feed should the content be sanitized?

I've been doing a lot of research and had several discussions in chat about learning to take a JSON feed and add the content to a post in WordPress. In the past I would create a page template and ...
2
votes
1answer
109 views

how to sanitize checkbox input?

I've added meta box: checkbox on admin edit screen <input type="checkbox" name="changeposition" /> So how could we sanitize the input came from the checkbox as we do for input type text by ...
1
vote
2answers
44 views

Is default functions like update_post_meta safe to use user inputs?

Is default functions like update_post_meta() safe to use user inputs? e.g. update_post_meta(76, 'my_key', $_GET['value']) Or should I use $_GET['value'] = sanitize_text_field($_GET['value']); ...
3
votes
1answer
62 views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
-1
votes
1answer
57 views

Customizer sanitize_callback for input type number

How to sanitize input control with "type" => "number". It would better if somebody actually explain in detail sanitize_callback on customizer.
0
votes
0answers
21 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
0answers
32 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
0
votes
1answer
36 views

Restrict characters in comment section

I am using Travelify theme and I am having some trouble restricting the characters in the comment section (textarea) or where the name or mail goes into the input tags. I read some articles about ...
0
votes
0answers
33 views

Join Wordpress databases from 2 different installs

I'm just now getting into SQL and the core of Wordpress (PHP). So I'm not an experienced WP developer but not intimidated by the tools. But, if the answers could be dummied down a bit would be very ...
1
vote
3answers
50 views

Echo JavaScript Safely

I am working on the data validation side of my WordPress theme. I have an option where user can input JS in the backend, and same is outputted in the front end between the script tags. The problem I ...
6
votes
2answers
2k views

What is the best way to sanitize data?

I've read several topics about this and different people have different views on the best practice. In terms of WordPress, how do I write data to the database the safest way? This is one insert I'm ...
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
-1
votes
1answer
32 views

wp_set_object_terms() without accents

How can I remove accents from term names before saving them to the database? // populate term if( empty ($d)) { } else { foreach ($d as $key=>$name){ ...
0
votes
0answers
30 views

Sanitization in wpdb insert not working

I have given below insert query and provided <script>alert("hello");</script> to insert in address field. But It seems its is not sanitized. In PHPMyadmin I am able to see the inserted ...
0
votes
0answers
39 views

Allowing all HTML tags in textarea

I'm developing a plugin that has a custom field which is a textarea that needs to accept all HTML tags. To sanitize the data, other than using wp_kses() and including an array of every HTML tag that ...
0
votes
1answer
38 views

What function removes apostrophes when making a slug?

I am trying to convert a post title to a slug. I used sanitize_title_with_dashes, thinking that's what WordPress uses. However, if my post title has an apostrophe in it, sanitize_title_with_dashes ...
1
vote
1answer
245 views

How to use sanitize_callback?

Theme Check is telling me add_setting() should have a sanitize_callback function so I tried to add one. This is for a color selector: $wp_customize->add_setting($setting_name, array( ...
1
vote
1answer
96 views

Data Validation: Always escape late / escape HTML Code

I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late" I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved ...
0
votes
3answers
2k views

Sanitize textarea instead of input

I want to add a new field to the user registration. I'm using this tutorial by Paul Underwood. The tutorial works but I want to switch the input text to a textarea which I do know how to do. The ...
1
vote
1answer
78 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
0
votes
0answers
78 views

Sanitizing the categories input from a front end posting form

I use this solution as a development base to add a front end posting functionality to one of my Wordpress sites. I added categories to the mentioned solution, but I don't know how correctly to filter ...
4
votes
5answers
2k views

Sanitize User Entered CSS

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like ...
0
votes
0answers
39 views

Theme Customizier sanitize_callback not working

I have a theme option to set the slider speed. The sanitize_callback function is not working. I would like the function to set the speed to 4000ms if a non numeric character is entered. function ...
1
vote
1answer
69 views

Storing HTML in wp_options

I'm giving my users the option to store HTML in an option with a wp_editor(), using the wp settings api to handle the form. I currently do not apply any data sanatization to it, but realize I probably ...
0
votes
2answers
545 views

What's The Proper Way To SAnitize Checkbox Value Sent To The Database

I have tried using sanitize_text_field() and esc_attr() to filter checkbox data when saving their values to the database, but it is causing the data not being saved. What is causing it and what's the ...
1
vote
1answer
81 views

Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?

I'm writing a plug-in that stores UNIX datetimes in browser cookies and that also uses a $_POST variable based on a simple form that sends the ID number of the current WordPress post. After reading ...
1
vote
1answer
228 views

How to sanitize post meta field value?

I have added a meta field for text input. I want to allow some html tags such as <strong> and <i> For example: <strong>hello</strong> world I can save the input field value ...
0
votes
1answer
351 views

Remove tinyMCE from admin and replace with textarea

I have created a plugin wherein I have a custom post type. I am using post_content for some simple text. I do not need to offer any fancy editing or insertion of data for this field, so I looked for a ...
1
vote
1answer
31 views

Are all hooks/functions tied to Kses meant for sanitization?

I'm currently learning WordPress hooks and am delving into core to see what's happening in there. I noticed there are filters in wp-includes/default-filters.php with PHP comments about Kses. I wasn't ...
12
votes
3answers
1k views

Should I sanitize an email address before passing it to the is_email() function?

I'm using is_email() to check if a user-provided email address is valid. For example: $email = $_POST['email']; if ( is_email( $email ) ) // Do something. To the best of my knowledge, nothing ...
0
votes
1answer
351 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
1answer
83 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($...
0
votes
1answer
651 views

Safely store code(html/js..) into database

So I'm working on a small plugin, and this plugin allows users to save data to my db. This data is mostly plain text but 3 fields are will have tags inside them. 1 field can be used to save all kind ...
0
votes
0answers
344 views

sanitize_text_field and apostrophe problem

I've written a custom plugin to send data via a form to a personal database, different from the WP one. Everything is working fine except the fact that when you write a name, for example D'ALESSANDRO, ...
3
votes
1answer
675 views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
1
vote
0answers
32 views

Change wp_sanitize function?

I have a domain name like s├ęp. wp_sanitize functions clears the ├ęcharacter. I would like to change it, but I cannot redeclare in functions.php. Is it possible to change, or WordPress cannot run ...
0
votes
1answer
65 views

Comparing pre-saved post_title to post-saved post_title

I'm implementing an inventory updater on a Wordpress product site that integrates with a 3rd-party website via their custom api. We're going to have a number of people updating the 3rd-party website, ...
0
votes
1answer
82 views

Sanitization html output itself

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a ...
0
votes
1answer
412 views

Can A Post Meta Field Store multiple values that are not in an array?

I have a post_meta field that seems to be displaying multiple values, yet they do not seem to be in an array. Using debug bar, this is what I see inside of the '_custom_post_type_onomies_relationship'...
0
votes
1answer
69 views

Why the WP Core team does not allow filter_* functions? [closed]

This question is somehow related to this other question. Provided that is seems we have a solution for the magic quotes issues, why the WP Core team does not allow them? This is unclear to me and I ...
0
votes
1answer
291 views

esc_attr on get_post_meta [closed]

Simple question, I see that some themes are using esc_attr or esc_html and url after they define varible with get_post_meta, while others are using it during variable definition. What would be best ...
0
votes
0answers
116 views

How to disable special character sanitizing for slugs

We are trying to track specific blog posts that are shared on social media sites and tech blogs. I selected Google Analytics for this and using Google UTM URL builder, I created a custom campaign link....
0
votes
1answer
105 views

Using esc_url_raw with protocols properly

I'm trying to build up my own function to sanitize a URL before saving it to my WP database. However I cannot get esc_url_raw to trigger against unwanted protocols. The function below is letting all ...
0
votes
1answer
114 views

Filter string like a slug

I have a WordPress site using pretty permalinks. I want to filter a string to that the it ends up with the exact same formatting as the url slug, does anyone know the filter or function to do so?
0
votes
1answer
71 views

How to handle complex data with Settings API

I hope my question isn't out of the scope of this website and that someone can help me with it. I'm currently studying the WP Settings API and I'm wondering how to create a form management section ...
0
votes
1answer
260 views

Trouble creating custom sanitization function for user list dropdown

I'm trying to create a custom author info box on homepage which will automaically generate by getting the info from user profile when a user is selected from theme customizer. I followed the code ...