Secure way to use name_save_pre?

Question

I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:

add_filter('name_save_pre', 'save_name');
function save_name($name_to_ignore) {
         global $post, $meta_box, $wpdb;

     $this_post_id = $post->ID;
         // verify nonce -- checks that the user has access
     if ( !isset($_POST['wp_nonce']) || !wp_verify_nonce( $_POST['wp_nonce'], basename(__FILE__) )) {
        return $post_id;
    }
         if ($_POST['post_type'] == 'mytype') :
          $name1 = $_POST['term1'];
          $name2 = $_POST['term2'];
          $name3 = $_POST['custom_field_1'];
          $name4 = $_POST['custom_field_2'];
          $my_post_name = $name1."-".$name2."-".$name3."-".$name4."-".$this_post_id;
        endif;
        return $my_post_name;
}

I just want to is it secure to save the data this way. Cause I read somewhere else (which is I forgot where), said that using $_POST['Custom_field']; is very easy to get hacked. Is it true?

Answer 1

Validate input values and sanitize outputting data. Take a read good article about Data Sanitization and Validation With WordPress, it will make you understanding these principles better.