If I'm allowing a user to enter an email address to be saved into the database, should I use
update_user_meta( $user_id, $social_site, sanitize_email( $_POST[$user_input] ) );
is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either
true if the string passes all the function checks or
false if it doesn't.
sanitize_email() will take the provided string and strip out any characters that are not allowed in an email address and return only the characters that are allowed.
So if you had a string that needs to be an email like:
is_email() would return
false as the string contains characters that are not allowed in an email address.
sanitize_email() would return
If you take
user"!@provider.com and first run it through the
sanitize_email() function and then through the
is_email() function it would then return
true in this case as all the invalid characters are removed from the string and this allows the string to pass the
I would suggest using both, is_email() to check first if the user submitted a proper email address and before commiting anything into the database check that is is indeed safe by running the sanitize_email() function at the latest possible point in your script.