Skip to main content
added 67 characters in body
Source Link
Tom J Nowell
  • 60.6k
  • 7
  • 77
  • 147

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.

If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend against using the wpdb object to write rawwriting SQL queries as it bypasses object caches etc, but if you must write your own SQL, use wpdb to prepare and execute it

For calls such as WP_QueryWP_Query, get_postsget_posts, add_post_metaadd_post_meta etc etc sanitisation occurs

Note that this is purely DB sanitisation, any additional sanitisation or validation you require, such as trimming trailing spaces, validation of URLs, stripping tags, escaping, etc, must all be done in your code

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.

If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend against using the wpdb object to write raw SQL as it bypasses object caches etc

For calls such as WP_Query, get_posts, add_post_meta etc etc sanitisation occurs

Note that this is purely DB sanitisation, any additional sanitisation or validation you require, such as trimming trailing spaces, validation URLs, stripping tags, escaping, must all be done in your code

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.

If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend against writing SQL queries as it bypasses object caches etc, but if you must write your own SQL, use wpdb to prepare and execute it

For calls such as WP_Query, get_posts, add_post_meta etc etc sanitisation occurs

Note that this is purely DB sanitisation, any additional sanitisation or validation you require, such as trimming trailing spaces, validation of URLs, stripping tags, escaping, etc, must all be done in your code

Source Link
Tom J Nowell
  • 60.6k
  • 7
  • 77
  • 147

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.

If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend against using the wpdb object to write raw SQL as it bypasses object caches etc

For calls such as WP_Query, get_posts, add_post_meta etc etc sanitisation occurs

Note that this is purely DB sanitisation, any additional sanitisation or validation you require, such as trimming trailing spaces, validation URLs, stripping tags, escaping, must all be done in your code