New answers tagged sanitization
When accepting user data inputs, I think that data validation must be performed if possible, not only sanitization. For example, you could expect a number, a bool value, a text string (even when the input is a selectbox it can have a string value), etc. You can santize for that data types; then you can go further and validate the data against expected ...
You can use any of the sanitation functions built into Wordpress (such as sanitize_text_field). Alternatively, if you are worried about specific elements being injected into the select options you can write you own sanitation function with the sanitize_meta function.
You are execpeting a WP Error object if the URL has a non-valid protocol but esc_url_raw returns an empty string in that case (see codex), not a WP Error object. So, is_wp_error( $escaped ) never verifies. Also, you are checking an undefined $escaped variable (note that the value of esc_url_raw is stored in $sanitized variable): function ...
Top 50 recent answers are included