Proper Way to Sanitize Meta Input

Question

I have a meta field which gets displaed in the admin panel look like:

$field = get_post_meta($postid, 'field_name', true); ?>
<input type="text" name="field_name" value="<?php echo (!empty($field)) ? $field : ''; ?>" />

And usually whenever I save these sorts of things I use sanitize_text_field() which I thought that was enough, until today... Today I realized that it doesn't properly encode any html entities, such as quotations. For example: Say the user enters into my text field

Matt said "Jet fuel can't melt steel beams..."

Which can be sanitized using the function above but whenever echo'ed back out to the user I get

Matt said

The input looks like:

<input type="text" name="field_name" value="Matt said " Jet fuel can't melt steel beams" />

I can use htmlspecialchars() whenever saving my meta but then that defeats the purpose. Why would I ever use sanitize_text_field() over strip_tags( htmlspecialchars() ) ?

Answer 1

You need to escape data while displaying also. Use esc_attr in your case. Try this:

<input type="text" name="field_name" value="<?php echo (!empty($field)) ? esc_attr( $field ) : ''; ?>" />

Check this for full documentation - https://codex.wordpress.org/Data_Validation