Skip to main content
Forgot the "\r"
Source Link
Sally CJ
  • 39.9k
  • 2
  • 26
  • 48

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

Additional Notes

Also, you should use esc_textarea() (although the output may not contain HTML tags):

<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
  esc_textarea( $content ); ?></textarea>

And you'd also want to remove line break after each <br />:

$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n\r\n|\n|\r)#", '<br />', $itinerary ); // this is what I meant

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

Additional Notes

Also, you should use esc_textarea() (although the output may not contain HTML tags):

<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
  esc_textarea( $content ); ?></textarea>

And you'd also want to remove line break after each <br />:

$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n)#", '<br />', $itinerary ); // this is what I meant

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

Additional Notes

Also, you should use esc_textarea() (although the output may not contain HTML tags):

<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
  esc_textarea( $content ); ?></textarea>

And you'd also want to remove line break after each <br />:

$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n|\r)#", '<br />', $itinerary );
added 595 characters in body
Source Link
Sally CJ
  • 39.9k
  • 2
  • 26
  • 48

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

Additional Notes

Also, you should use esc_textarea() (although the output may not contain HTML tags):

<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
  esc_textarea( $content ); ?></textarea>

And you'd also want to remove line break after each <br />:

$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n)#", '<br />', $itinerary ); // this is what I meant

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this

Additional Notes

Also, you should use esc_textarea() (although the output may not contain HTML tags):

<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
  esc_textarea( $content ); ?></textarea>

And you'd also want to remove line break after each <br />:

$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n)#", '<br />', $itinerary ); // this is what I meant
Source Link
Sally CJ
  • 39.9k
  • 2
  • 26
  • 48

From the reference/description of sanitize_text_field():

  • Checks for invalid UTF-8,

  • Converts single < characters to entities

  • Strips all tags

  • Removes line breaks, tabs, and extra whitespace

  • Strips octets

So a simple fix is, use sanitize_textarea_field():

The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.

// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] );   // and not this