I have a meta field which gets displaed in the admin panel look like:
$field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($field)) ? $field : ''; ?>" />
And usually whenever I save these sorts of things I use
sanitize_text_field() which I thought that was enough, until today... Today I realized that it doesn't properly encode any html entities, such as quotations. For example: Say the user enters into my text field
Matt said "Jet fuel can't melt steel beams..."
Which can be sanitized using the function above but whenever echo'ed back out to the user I get
The input looks like:
<input type="text" name="field_name" value="Matt said " Jet fuel can't melt steel beams" />
I can use
htmlspecialchars() whenever saving my meta but then that defeats the purpose. Why would I ever use
strip_tags( htmlspecialchars() ) ?