0

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code:

functions.php

function zz_style($properties, $values) {

    $styles_array = array();
    $i = 0;

    foreach ($properties as $property) {

        if ($values[$i] != null) {

            $styles_array[] = $property . ':' . $values[$i];
        }
        $i++;

    }

    return 'style="' . implode(";", $styles_array) . '" ';

}

index.php

$zz = get_theme_mod('zz');

<div <?php echo zz_style(array('color'),array($zz['colorA'])); ?>></div>

Options I can think of:

wp_kses(zz_style(...));

zz_style(array('color'),array(sanitize_hex_color($zz['colorA'])));

wp_kses(zz_style(array('color'),array(sanitize_hex_color($zz['colorA']))));

So my question is how should I sanitize this? Sanitize it in the functions.php or in the index.php?

  • Where is the information coming from? The database or user input? – Andrew Bartel Nov 25 '14 at 18:07
  • It is coming from user input. – Alvaro Nov 25 '14 at 19:52
  • Looking at the code, you have a $zz = get_theme_mod('zz'); which pulls a setting from the database. Is that what you want to sanitize? When I mean user input, I mean data from a form being filled out, or whatever, which you're then going to put into a database. As a rule, you want to sanitize data going in, and escape it coming out. So, this is coming out right? This article should help a ton. – Andrew Bartel Nov 25 '14 at 22:07
  • Ok, thanks sorry for the misunderstood. Yes, data will come from Post Metaboxes and Customizer. Ill take a deeper look. – Alvaro Nov 26 '14 at 0:02
  • It says: "Tip: It's best to do the output validation as late as possible, ideally as it's being outputted, as opposed to further up in your script. This way you can always be sure that your data is properly validated/escaped and you don't need to remember if the variable has been previously validated." Should I follow the tip in this case? I can think if the data is not correctly formatted before entering the function then it might return an incorrect value and never appear in the front end. – Alvaro Nov 26 '14 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.