1

I want to add a new field to the user registration. I'm using this tutorial by Paul Underwood.

The tutorial works but I want to switch the input text to a textarea which I do know how to do. The problem is making sure WordPress saves this information correctly.

I realized it's because of sanitize_text_field( $_POST['facebook_profile'] )

I'm trying to find a way to accomplish the same thing for textarea instead of text field but I'm not finding anything (that I understand. I'm new as a PHP developer). How can I make it so that the textarea information is saved?

Here is the exact code I'm using:

add_action( 'show_user_profile', 'add_extra_social_links' );
add_action( 'edit_user_profile', 'add_extra_social_links' );

function add_extra_social_links( $user )
{
    ?>
        <h3>Additional Information</h3>

        <table class="form-table">
            <tr>
                <th><label for="facebook_profile">Facebook Profile</label></th>
                <td><input type="text" name="facebook_profile" value="<?php echo esc_attr(get_the_author_meta( 'facebook_profile', $user->ID )); ?>" class="regular-text" /><BR><span class="description">Please enter your Twitter username.</span></td>
            </tr>
        </table>
    <?php
}
get_the_author_meta( $field, $userID ); 
update_user_meta( $user_id, $meta_key, $meta_value, $prev_value );

add_action( 'personal_options_update', 'save_extra_social_links' );
add_action( 'edit_user_profile_update', 'save_extra_social_links' );

function save_extra_social_links( $user_id )
{
    update_user_meta( $user_id,'facebook_profile', sanitize_text_field( $_POST['facebook_profile'] ) );
} 
3

Since WordPress 4.7 there is sanitize_textarea_field().

Which does exactly as you want, from the Codex.

Sanitizes a multiline string from user input or from the database.

2

wp_kses_post if you want to allow certain HTML in your textarea/wp editor (safest, as @Bordoni said).
esc_textarea is what you might looking for.

1

There is a couple solution to your problem, some of them will give you more flexibility others will make the field safer.

I like to use wp_kses_post the most, because it will only allow the HTML that you would have accepted on a post, but if you want to remove all HTML tags you would go for a wp_kses( $string_unsafe, array() ).

You can also go for a sanitized input method you quoted above, but using it line-by-line to provide you with the solution you want.

// When dealing with user input always cast the input as you expect it to be
$lines = explode( "\n", (string) $_POST['facebook_profile'] );

// Apply the method
$lines = array_map( 'sanitize_text_field', (array) $lines );

update_user_meta( $user_id,'facebook_profile', implode( "\n", $lines );

As it was pointed below — Going with the answer above might not be the best option, but it's a solution that you can consider.

4
  • 2
    I am not sure it is smart to sanitize by line. Some things might ring the alarm when looking at the whole text but seems legit when you look only at specific line. Oct 26 '14 at 4:33
  • I updated the second to last line in my code to the one you provided, Bordoni, and it won't save.
    – Tara
    Oct 26 '14 at 4:52
  • @MarkKaplun I agreed without that's why I said that the first method is the best and @Tara what you can do is activate the WP_DEBUG constant then post here the error so that I take a look on what is happening.
    – Bordoni
    Oct 26 '14 at 6:58
  • I can use the first method, but I'm a little unsure about how to do it. Can you explain a little more?
    – Tara
    Oct 26 '14 at 14:35
0

PHP has built-in funtions for sanitizing with filter_var(). You just call the function, feed it the variable containing your data, and tell it which filter to use and any optional flags:

$myTextArea = "This is the data from my text area";
$mySanitizedText = filter_var($myTextArea, FILTER_SANITIZE_STRING);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.