Is it necessary to sanitize plugin options?

Question

I've always known that it's good practice to sanitize GET and POST data. I usually do this globally in my functions file with code like this:

$_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
$_GET  = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);

With plugins that have a Settings screen, using the recommended code for plugins according to the plugin API, is it necessary to sanitize user inputs on the plugin's Settings page, like checkboxes, text fields, etc?

Or does the Plugin API take care of POST/GET sanitization on plugin Settings screens?

Note that using the above code block gives me the message "your link has expired" when saving plugin options (via the "Save" button on the plugin's settings screen).

What is the best practice for sanitizing plugin settings?

Answer 1

Here's what I found out, with appreciation for the comments to the question.

I write WP code (themes and plugins) and non-WP PHP code (for non-WP sites). In non-WP sites, I include those statements in my 'include' file to ensure POST/GET sanitation, even though I try to sanitize the fields elsewhere. So, sort of a 'sanitize backup plan'.

But putting the code in a WP plugin file too soon kills the plugin's settings screen and/or the front end; more often on the front end with the plugin enabled (result is sometimes a white screen).

So, for WP plugins/themes, I will ensure sanitization of individual POST/GET fields, rather than the above code.

In non-WP sites, though, the above code is benign - sort of a double-check-sanitation thing, even though I try to remember to sanitize POST/GET fields before using that data.