Tag Info

Hot answers tagged

12

There are two concepts here: validation - making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation - making the date safe for its use in the current context (e.g. escaping SQL queries, or escaping HTML on output). Validation is, almost universally, ...


7

Remove the filter from the the_content and run it after the shortcode are processed. Try: remove_filter( 'the_content', 'wpautop' ); add_filter( 'the_content', 'wpautop' , 12); Usually shortcodes are processed after wpautop is applied to the content. See http://core.trac.wordpress.org/browser/tags/3.1/wp-includes/shortcodes.php#L296


7

You can stop the post from saving all together with minor JQuery hacks and validate the fields before saving on the client side or server side with ajax: first we add our JavaScript to capture the submit/publish event and use it to submit our own ajax function before the actual submit: add_action('wp_print_scripts','my_publish_admin_hook'); function ...


7

The short answer; absolutely. wp_insert_post() will only SQL escape the content. Use the KSES library & wp_kses() to filter out the nasties, or esc_html() to escape all HTML. Most importantly, check out the codex on data validation (read: sanitization). A Note On KSES: Use wp_filter_kses() or wp_kses_data() to apply the same KSES rules as post ...


7

There are several components to error/notice creation and display process: add_settings_error() call to add item to stack (global $wp_settings_errors variable). settings_errors transient that keeps the errors so they survive move from page to page. settings_errors() function get_settings_errors() to retrieve errors from memory or transient and then ...


6

There's no reason a WordPress site can't pass validation, it's entirely up to the theme designer.


6

Simple fix: <div <?php post_class("clearfix"); ?>> See post_class() for more details


6

Actually you can bypass login mechanism of wordpress by login user automatically (after they succesfuly passed with credentials from another website for example) with this function: wp_set_auth_cookie($user_id); for example with this you do login admin (user with id = 1) wp_set_auth_cookie(1); //after this admin is logged in so you can create user in ...


5

Filter the_category, and remove those attributes: add_filter( 'the_category', 't5_remove_cat_rel' ); function t5_remove_cat_rel( $list ) { return str_replace( array ( 'rel="category tag"', 'rel="category"' ), '', $list ); }


5

You're on the right track. I test the fields in the save_post callback, and then use admin notices to display errors to the user when a field fails validation. They show up just in a highlighted box at the top of the page, just like any errors/messages that WordPress itself generates. Here's a simple example of creating an admin notice: function ...


5

What you need to do is build your own data validation function. Ozh wrote a great tutorial about this earlier, but here's the gist of it ... Assume your options array is called $my_options and it contains three fields, 'text', 'age', and 'isauthorized'. You would still register it the same way: register_setting( 'my_setting', 'my_options', ...


5

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


4

Using $_POST is too low level. Simply give it the same name as your other options. When you options are displayed they should have the names of the form: my_settings[a_particular_option]. For instance: <input name="my_settings[some_input_option]"/> Then for your hidden input and submit button: <input type="hiddden" name="my_settings[foo]" ...


4

Simply put the wp_insert_post call inside your conditional check so its only called if the post title is not empty, something like this: if (empty($_POST['my_title'])){ echo 'error: please insert a title'; } else { $title = $_POST['my_title']; $new_post = array( 'post_title' => $title, 'post_status' => 'publish', ...


4

The simple reason is that WC3 CSS validation is not very important, you can do better things with your time that will effect your actual users. I'm not saying standards are not important , but with proper testing it is rather easy to ensure compatibility, but strict validation is not followed because many useful techniques are just not valid. For example ...


3

hook the_posts and inspect each post to see if your shortcode is present, you can use wp_enqueue_style at that point if it is. maybe a bit of regex to check for the presence of the shortcode is the way to go, unfortunately i'm not very good with regex! function wpse27772_has_shortcode($posts) { if ( empty($posts) ) return $posts; ...


3

Is 'sql injection' already a part of that function or do I need to add my own code? When inserting input to the database you should use prepare method of WPDB class which supports both a sprintf() - like and vsprintf() -like syntax. read more at the codex Are there wordpress form input validation functions that I can use on my custom form? Yes ...


3

There are two steps to the method: first, a function to save your custom metabox field data (hooked to save_post), and second, a function to read that new post_meta (which you just saved), validate it, and modify the result of saving as necessary (also hooked to save_post, but after the first). The validator function, if validation fails, actually changes ...


3

It appears you are using an HTML 5 theme. The W3C doesn't validate all HTML output even though it might be "valid code". The errors you've sent are generated by WordPress and most can be removed fairly easy by de-registering the WordPress Hooks which are causing them. The hooks are used to achieve things like grouping galleries, categories, and other similar ...


3

Example code in add_meta_box() documentation uses save_post hook (at the very end of wp_insert_post() function) to add custom fields data from metabox. You must be using something like that already in your metaboxes, is it not appropriate place to validate your data?..


3

Not shure if this isnĀ“t a general php question... Use the WP_Error Class. // http://php.net/manual/de/function.is-float.php // http://php.net/manual/de/function.is-int.php // inside your save_post/update_post hooks callback function, // just type cast to float. You could also do a check if it contains non numeric chars // and then simply return; $check = ...


3

Some rel= attributes don't have valid markup, it's really not a big deal, for instance the word tag is HTML valid, but the word category is not. If your loop uses the_category , or wp_list_categories ( I think), you can replace it with the following, function add_nofollow_cat( $text ) { $valid_tag = 'rel="tag"'; $text = ...


3

If you have an options page (which should be inside one form), then all data is sent from that form, regardless of whether or not the option has been changed. The array received for validation is the data received from (your part of) the form. If the data is 'empty' it is because the data wasn't sent. Normally this would be because the user has deliberately ...


3

In the articles case, $title is an arbitrary value, as such it should be escaped via html, but, if it was gotten from a WordPress core function it is probably safe, but you should check anyway For example, get_the_title() can contain html markup and is not escaped by default. Eitherway post and page titles should not have html in them. Styling is for ...


3

Investigating the filter authenticate, we can find that it is called inside the function wp_authenticate, which is a pluggable function. That means that it can be replaced by one of our own making. This is the original function, plus a marked entry point: function wp_authenticate($username, $password) { $username = sanitize_user($username); ...


2

Your code works just fine on my end. So, I'd say your problem is elsewhere. Troubleshooting guide. You can use standard debugging or FirePHP. I also use the following for cases where FirePHP doesn't display information, i.e., save_post. function my_log( $msg, $title = '' ) { $error_dir = '/Applications/MAMP/logs/php_error.log'; $date = date( ...


2

Use sessions <?php session_start(); // your fomrfields $post_fields = array( 'key_one', 'key_two', 'key_three' ); $form_data = array(); // copy needed form data from $_POST array foreach ( $post_fields as $key ) if ( isset( $_POST[$key] ) $form_data[$key] = $_POST[$key]; // save your form data in a session if no form data was saved before if ( ...


2

I would do this by hooking into the save_post action, not by javascript. The main idea is to check if both values are there (Your Radiobutton is selected AND the post_thumbnail is present), and set the post to draft if they are not, as well as displaying an Information if the user does not fulfill the requirements. First, hook into the save_post action, ...


2

WordPress doesn't provide any specific data validation functions for SUPERGLOBALS. I use the PHP filter_input function then escape it as I would any untrusted variable. $url = filter_input( INPUT_GET, 'some_query_string', FILTER_VALIDATE_URL ); echo '<a href="'. esc_url( $url ). '">Click Me</a>'; The PHP filter input accepts: Validate ...


2

To your specific example: You sanitized the $_GET data appropriately (thought I would use sanitize_key instead of sanitize_title -- can't say there's much of a difference, but sanitize_title is intended for use in URLs). The method_exists function will return true for private and protected methods, so if a user tries to call a private or protected method, ...



Only top voted, non community-wiki answers of a minimum length are eligible