Sanitizing, Validating and Escaping in WordPress (Plugin)

Question

I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some security issues. More specifically, it is about the fact that data must be Sanitized, Escaped, and Validated.

Unfortunately, I completely forgot about this point during development. Now I have familiarized myself with the above principles via the documentation and I think I have understood them now, however I am still unsure how to apply this practically in some places.

1. Highlight the active menu item

To highlight the active menu item I have written a small helper function:

protected function get_current_site() {
    $page = $_GET['page'];
    return $page;
}

The function is used in the header:

<li <?php if($this->get_current_site() == 'myplugin-settings') { echo 'class="active"'; } ?>><a href="?page=myplugin-settings">Settings</a></li>

How do I apply the three principles (Sanitized, Escaped, and Validated) here?

2. Toggle status via AJAX

To change the status of my plugin I use a small function via AJAX. Here $_POST["active"] contains either 0 or 1:

$this->loader->add_action('wp_ajax_toggle_myplugin', $this, 'toggle_myplugin');

public function toggle_myplugin() {
    $active = $_POST["active"];
    $status = update_option('myplugin_status', $active);
    echo $status;
    wp_die();
}

How do I apply the three principles (Sanitized, Escaped, and Validated) here?

3. Dynamic rendering of a template

I use a GET variable to output a different template on a specific page of my plugin:

public function render_template() {
    if(isset($_GET['action'])) {
        $action = $_GET['action'];
        switch($action) {
            case("edit"):
                include MYPLUGIN_ROOT_PATH . 'includes/admin/templates/template1.php';
                break;
            case("add"):
                include MYPLUGIN_ROOT_PATH  . 'includes/admin/templates/template2.php';
                break;
            default:
                include MYPLUGIN_ROOT_PATH  . 'includes/admin/templates/template3.php';
        }
    }
}

How do I check the action variable?

4. Check value from an hidden input-field

I use hidden input-field to pass hidden values (in my case an ID):

<input type="hidden" name="id" value="<?php echo $id; ?>">

public function actions() {
    if($_SERVER['REQUEST_METHOD'] == 'POST') {
        $action = $_POST["action"];
        switch($action) {
            case "edit":
                $id = $_POST["id"];
                $name = $_POST["name"];
                [...]
                break;
            case "add":
                $name = $_POST["name"];
                [...]
                break;
    }
}

Thank you very much in advance. Please be gracious as this is my first plugin.

Answer 1

Now I have familiarized myself with the above principles via the documentation and I think I have understood them now

I don't know which documentation you read, but you should check the Plugin Security section in the plugin developer's handbook.

And there are three main issues I noticed in your code:

1. Before attempting to use a $_GET or $_POST variable, you should check whether it's set or not.

   So for example in your get_current_site() function, instead of $page = $_GET['page'];, you should do:

   $page = isset( $_GET['page'] ) ? wp_unslash( $_GET['page'] ) : '';
   

2. In your toggle_myplugin() function, you should sanitize the option value (prior to updating the option) using functions like sanitize_text_field():

   $active = isset( $_POST['active'] ) ? sanitize_text_field( $_POST['active'] ) : '';
   

3. In your hidden input field, you should escape the input value using functions like esc_attr(). So instead of simply echo $id;, you would use echo esc_attr( $id );:

   <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>">
   

So I hope that helps and feel free to ask if you need any clarification, and as the plugin handbook recommends, consider checking user capabilities and using nonces (checking user's intent) where appropriate in your plugin.