Tag Info

New answers tagged


If you want to validate the data then you'll have to try retrieve user via ID. To only sanitize ID since it's numeric is enough to cast it as integer, absint() will work fine as a callback.


The Problem This turned out to be a common case of needing to use stripslashes();. How did I figure this out? I logged into phpMyAdmin, navigated to the options table, found my option name, and edited it. Here's what I discovered... s:11:"description";s:90:"<span style=\"text-decoration: underline;\">This is supposed to be underlined ...


Sanitize all the things! One of the cardinal rules of security is to never trust the input from the user. In general, I don't care about the implementation of is_email() or any other specific function, or if that function does anything dangerous with what I give it. Maybe the implementation will change some day. Who knows. I have to assume it can be ...


WordPress and PHP core The is_email() function Source is a typical WordPress implementation and does not work completely with what the RFC 6531 allows. One reason might be, that the default PHP FILTER_VALIDATE_EMAIL constant for filter_var() isn't much better at validating something according to the The Internet Engineering Task Force (IETF®) guidelines. ...


Looking at the is_email() functionality on trac, it looks like you don't need to sanatizie as it's just string testing. I would even go so far as to say that if this function returns true, you wouldn't need to sanitize it before sending it into the database.

Top 50 recent answers are included