Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

learn more… | top users | synonyms (1)

3
votes
1answer
671 views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
3
votes
1answer
10k views

Custom page with variables in url. Nice url with add_rewrite_rule

Using WP3.1 I Have a custom page with a WP_Query and the query gets dynamic variables from the url. And i want safe variables and clean urls. Example: carpage/?carmodel=honda&location=...
14
votes
2answers
746 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
6
votes
2answers
2k views

What is the best way to sanitize data?

I've read several topics about this and different people have different views on the best practice. In terms of WordPress, how do I write data to the database the safest way? This is one insert I'm ...
5
votes
1answer
2k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
4
votes
3answers
919 views

Reason for Lowercase usernames

I can see validate_user() calls sanitize_user() with strict argument as true, which means uppercase letters are not allowed too. In source code, I found this comment // If strict, reduce to ASCII ...
4
votes
5answers
2k views

Sanitize User Entered CSS

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like ...
2
votes
2answers
2k views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
1
vote
3answers
886 views

How do I sanitize a javascript text?

I have a textarea that will receive a js snippet(Google Analytics). Is there a way to sanitize that? Since I cannot use functions like wp_filter_nohtml_kse(), what should I use?
0
votes
2answers
665 views

Sanitaizing Select Optin For Custom Post Type Metabox in WP

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as: <label for="my_meta_box_select">Countries</label> <select ...