New answers tagged

3

Input from the user or other functions etc you validate and sanitize. For sanitizing sql strings before execution (important one!) look at this page http://codex.wordpress.org/Data_Validation under Database. When you want to sanitize input from a not trusted source then sanitize look under text input or use ...


5

Yes it does. Escaping depends on context and in worst case like using esc_html when writing directly to the DB are just a security hole. Even if there is no security issue, there is theoretical one. The user asked you to store A, and you are storing B. In a simple cases B is exactly how A should be displayed in the HTML, but life is rarely simple and while ...



Top 50 recent answers are included