New answers tagged


Input from the user or other functions etc you validate and sanitize. For sanitizing sql strings before execution (important one!) look at this page under Database. When you want to sanitize input from a not trusted source then sanitize look under text input or use ...


Yes it does. Escaping depends on context and in worst case like using esc_html when writing directly to the DB are just a security hole. Even if there is no security issue, there is theoretical one. The user asked you to store A, and you are storing B. In a simple cases B is exactly how A should be displayed in the HTML, but life is rarely simple and while ...


You can hook into the loading of any admin screen with add_action( 'load-post.php', 'tbdn_post_screen' ); function tbdn_post_screen() { // Check here whether you're adding a post or // editing a post by seeing if $_GET['action'] // equals 'edit' then add your meta for post with // ID $_GET['post'] } Details of all of the admin screen ...


In the end it was a plugin and my code conflicting with each other. Both were saving my post_meta. Resulting in odd behavior of my code and functionality of retrieving the data.


A minor update (I ran into this issue today): The above solution does not work anymore. The only thing you need to do nowadays is to set the post_parent: wp_update_post(array( 'ID' => $booking->id, 'post_parent' => $order->id ));

Top 50 recent answers are included