I have a plugin with a few text boxes that save the data in a serialized manner, the array is localized and printed in website front end to display custom messages. However, I just noticed that you can add html and javascript inside the text boxes, is there anyway to disallow this kind of content?

sanitize_text_field( $str )
  • Sanitize a string from user input or from the db.

  • Checks for invalid UTF-8, Convert single < characters to entity, strip all tags, remove line breaks, tabs and extra white space, strip octets


  • Can I do something in the type text like value="<?php $title = sanitize_text_field(get_option('lu_ban_data')); echo $title['title']; ?>" – David Garcia Jul 16 '13 at 18:01
  • You would use sanitize_text_field() before saving the value with update_option(). When retrieving the option, I believe you will need to convert html entities back to characters: $title = htmlspecialchars_decode(get_option('lu_ban_data')); echo $title; – Mike Jul 16 '13 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.