I have a plugin with a few text boxes that save the data in a serialized manner, the array is localized and printed in website front end to display custom messages. However, I just noticed that you can add html and javascript inside the text boxes, is there anyway to disallow this kind of content?

1 Answer 1

sanitize_text_field( $str )
  • Sanitize a string from user input or from the db.

  • Checks for invalid UTF-8, Convert single < characters to entity, strip all tags, remove line breaks, tabs and extra white space, strip octets


  • Can I do something in the type text like value="<?php $title = sanitize_text_field(get_option('lu_ban_data')); echo $title['title']; ?>" Jul 16, 2013 at 18:01
  • You would use sanitize_text_field() before saving the value with update_option(). When retrieving the option, I believe you will need to convert html entities back to characters: $title = htmlspecialchars_decode(get_option('lu_ban_data')); echo $title;
    – Mike
    Jul 16, 2013 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.