0

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as:

<label for="my_meta_box_select">Countries</label>
<select name="my_meta_box_select" id="my_meta_box_select">
<option value="asia" <?php selected( $selected, 'asia' ); ?>>Asia</option>
<option value="africa" <?php selected( $selected, 'africa' ); ?>>Africa</option>
<option value="america" <?php selected( $selected, 'america' ); ?>>America</option>
</select>

$selected = isset( $values['my_meta_box_select'] ) ? esc_attr( $values['my_meta_box_select'][0] ) : '';

so far I am using following code to save the selected option:

if( isset( $_POST['my_meta_box_select'] ) )
    update_post_meta( $post_id, 'my_meta_box_select', esc_attr( $_POST['my_meta_box_select'] ) );

But from the point of Security check I am not sure that this is safe enough?! Do I have to check anything more like Sanitizing or Escaping on this kind of inputs, as well?( I already learned that we can Sanitize Text inputs but not sure about Select, or Checkbox inputs

1

You should scape data when displaying it, not when saving. To sanitize, I think the best choice in this case is sanitize_text_field()

if( isset( $_POST['my_meta_box_select'] ) ) {
    update_post_meta( $post_id, 'my_meta_box_select', sanitize_text_field( $_POST['my_meta_box_select']   ) );
}

Then, only if you are going use the data as attribute you should use esc_attr():

$selected = isset( $values['my_meta_box_select'] ) ? esc_attr( $values['my_meta_box_select'][0] ) : '';
<select name="my_meta_box_select" id="my_meta_box_select">
   <option value="asia" <?php $selected == 'asia') ? 'selected'; ?>>Asia</option>
   <option value="africa" <?php $selected == 'africa') ? 'selected'; ?>>Africa</option>
   <option value="america" <?php $selected == 'america') ? 'selected'; ?>>America</option>
</select>

If you want also validate the data, you should compare with a list of valid values (or other validation comparison), as Rarst suggested in his answer (in this case you could skip the sanitization because if the value has a not valid value you don't trigger the update_post_meta() function):

    if( isset( $_POST['my_meta_box_select'] ) ) {
        $value = $_POST['my_meta_box_select'];
        if ( in_array( $value, array('asia', 'africa', 'america'), true ) ) {
            update_post_meta( $post_id, 'my_meta_box_select', $value );
        }
    }
1
  • Just hairy, not female. :)
    – Rarst
    Feb 1 '14 at 19:35
0

You are trying to make sure that data is safe, but not validate it - that is make sure it is both safe and meaningful.

In your case you have a fixed set of values your data can be, it would make sense to check if data belongs to the set. Along the lines of this for example:

if ( in_array( $value, array('asia', 'africa', 'america'), true ) ) {
    // all good
}
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.