Sanitize textarea instead of input

Question

I want to add a new field to the user registration. I'm using this tutorial by Paul Underwood.

The tutorial works but I want to switch the input text to a textarea which I do know how to do. The problem is making sure WordPress saves this information correctly.

I realized it's because of sanitize_text_field( $_POST['facebook_profile'] )

I'm trying to find a way to accomplish the same thing for textarea instead of text field but I'm not finding anything (that I understand. I'm new as a PHP developer). How can I make it so that the textarea information is saved?

Here is the exact code I'm using:

add_action( 'show_user_profile', 'add_extra_social_links' );
add_action( 'edit_user_profile', 'add_extra_social_links' );

function add_extra_social_links( $user )
{
    ?>
        <h3>Additional Information</h3>

        <table class="form-table">
            <tr>
                <th><label for="facebook_profile">Facebook Profile</label></th>
                <td><input type="text" name="facebook_profile" value="<?php echo esc_attr(get_the_author_meta( 'facebook_profile', $user->ID )); ?>" class="regular-text" /><BR><span class="description">Please enter your Twitter username.</span></td>
            </tr>
        </table>
    <?php
}
get_the_author_meta( $field, $userID ); 
update_user_meta( $user_id, $meta_key, $meta_value, $prev_value );

add_action( 'personal_options_update', 'save_extra_social_links' );
add_action( 'edit_user_profile_update', 'save_extra_social_links' );

function save_extra_social_links( $user_id )
{
    update_user_meta( $user_id,'facebook_profile', sanitize_text_field( $_POST['facebook_profile'] ) );
} 

Answer 1

Since WordPress 4.7 there is sanitize_textarea_field().

Which does exactly as you want, from the Codex.

Sanitizes a multiline string from user input or from the database.

Answer 2

wp_kses_post if you want to allow certain HTML in your textarea/wp editor (safest, as @Bordoni said).
esc_textarea is what you might looking for.

Answer 3

There is a couple solution to your problem, some of them will give you more flexibility others will make the field safer.

I like to use wp_kses_post the most, because it will only allow the HTML that you would have accepted on a post, but if you want to remove all HTML tags you would go for a wp_kses( $string_unsafe, array() ).

You can also go for a sanitized input method you quoted above, but using it line-by-line to provide you with the solution you want.

// When dealing with user input always cast the input as you expect it to be
$lines = explode( "\n", (string) $_POST['facebook_profile'] );

// Apply the method
$lines = array_map( 'sanitize_text_field', (array) $lines );

update_user_meta( $user_id,'facebook_profile', implode( "\n", $lines );

As it was pointed below — Going with the answer above might not be the best option, but it's a solution that you can consider.

Answer 4

PHP has built-in funtions for sanitizing with filter_var(). You just call the function, feed it the variable containing your data, and tell it which filter to use and any optional flags:

$myTextArea = "This is the data from my text area";
$mySanitizedText = filter_var($myTextArea, FILTER_SANITIZE_STRING);