0
votes
1answer
30 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
2
votes
3answers
1k views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
14
votes
2answers
517 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
1
vote
1answer
30 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
1
vote
2answers
1k views

<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security

Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes. According to the above ...
2
votes
2answers
1k views

Correct Approach for Validating Custom Field Input

I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...