Sanitaizing Select Optin For Custom Post Type Metabox in WP

Question

Using WordPress 3.8.1, I have a Custom post Type called "Map" and it contains a Metadata which is a Select options element as:

<label for="my_meta_box_select">Countries</label>
<select name="my_meta_box_select" id="my_meta_box_select">
<option value="asia" <?php selected( $selected, 'asia' ); ?>>Asia</option>
<option value="africa" <?php selected( $selected, 'africa' ); ?>>Africa</option>
<option value="america" <?php selected( $selected, 'america' ); ?>>America</option>
</select>

$selected = isset( $values['my_meta_box_select'] ) ? esc_attr( $values['my_meta_box_select'][0] ) : '';

so far I am using following code to save the selected option:

if( isset( $_POST['my_meta_box_select'] ) )
    update_post_meta( $post_id, 'my_meta_box_select', esc_attr( $_POST['my_meta_box_select'] ) );

But from the point of Security check I am not sure that this is safe enough?! Do I have to check anything more like Sanitizing or Escaping on this kind of inputs, as well?( I already learned that we can Sanitize Text inputs but not sure about Select, or Checkbox inputs

Answer 1

You should scape data when displaying it, not when saving. To sanitize, I think the best choice in this case is sanitize_text_field()

if( isset( $_POST['my_meta_box_select'] ) ) {
    update_post_meta( $post_id, 'my_meta_box_select', sanitize_text_field( $_POST['my_meta_box_select']   ) );
}

Then, only if you are going use the data as attribute you should use esc_attr():

$selected = isset( $values['my_meta_box_select'] ) ? esc_attr( $values['my_meta_box_select'][0] ) : '';
<select name="my_meta_box_select" id="my_meta_box_select">
   <option value="asia" <?php $selected == 'asia') ? 'selected'; ?>>Asia</option>
   <option value="africa" <?php $selected == 'africa') ? 'selected'; ?>>Africa</option>
   <option value="america" <?php $selected == 'america') ? 'selected'; ?>>America</option>
</select>

If you want also validate the data, you should compare with a list of valid values (or other validation comparison), as Rarst suggested in his answer (in this case you could skip the sanitization because if the value has a not valid value you don't trigger the update_post_meta() function):

    if( isset( $_POST['my_meta_box_select'] ) ) {
        $value = $_POST['my_meta_box_select'];
        if ( in_array( $value, array('asia', 'africa', 'america'), true ) ) {
            update_post_meta( $post_id, 'my_meta_box_select', $value );
        }
    }

Answer 2

You are trying to make sure that data is safe, but not validate it - that is make sure it is both safe and meaningful.

In your case you have a fixed set of values your data can be, it would make sense to check if data belongs to the set. Along the lines of this for example:

if ( in_array( $value, array('asia', 'africa', 'america'), true ) ) {
    // all good
}