0

I got a meta-box. And it is almost working as it should. Except that it is'nt saving spaces. For example if I enter London City the data saved will be LondonCity I have taken a look at this SE: Why is my custom meta box input not saving And replace sanitize_html_class with esc_attr but then I get the following error message:

Parse error: syntax error, unexpected end of file in [FILEPATH]/functions.php on line 235

I have also tried to replace sanitize_html_classwith sanitize_text_field but then the saving function stops works and the data entered is'nt saving at all. I have also tried to use nothing and esc_html but then the same happens (values does'nt save/update)

What am I doing woring?/What am I missing?

Full code for the meta-box:

add_action( 'load-post.php', 'city_meta_box_setup');
add_action( 'load-post-new.php', 'city_meta_box_setup');


function city_meta_box_setup() {
    add_action( 'add_meta_boxes', 'city_add_meta_box');
    add_action( 'save_post', 'city_save_meta', 10,2);
}


function city_add_meta_box() {

    add_meta_box(
    'city_id', // $ID
    'City', // $TITLE
    'city_meta_box', // $CALLBACK
    'properties', // $PAGE
    'normal', // $CONTEXT
    'default' // $PRIORITY
        );
}

function city_meta_box($Object, $box) {
    /* wp nonce-hash */
    wp_nonce_field( basename(__FILE__), 'city_nonce'); ?>

<p> 
    <label for="city-id"><?php _e("Where is this property located? ex. New York", 'default'); ?> </label>
    <br/>
    <input class="widefat" type="text" name="city_id" id="city_id" value="<?php echo esc_attr( get_post_meta( $Object->ID, 'city_id', true ) ); ?>" size="30" />
</p>
<?php }


function city_save_meta( $post_id, $post ) {

    if ( !isset( $_POST['city_nonce']) || !wp_verify_nonce( $_POST['city_nonce'], basename(__FILE__) ) )
        return $post_id;


    $post_type = get_post_type_object( $post->post_type);

    if ( !current_user_can( $post_type->cap->edit_post, $post_id ) )
        return $post_id;

    $new_meta_value = ( isset( $_POST['city_id'] ) ? sanitize_html_class( $_POST['city_id']) : '');

    $meta_key = 'city_id';

    $meta_value = get_post_meta( $post_id, $meta_key, true );

    if ( $new_meta_value && '' == $meta_value )
        add_post_meta( $post_id, $meta_key, $new_meta_value, true );

    elseif ( $new_meta_value && $new_meta_value != $meta_value )
        update_post_meta( $post_id, $meta_key, $new_meta_value );

    elseif ( '' == $new_meta_value && $meta_value )
        delete_post_meta( $post_id, $meta_key, $meta_value );
}

1 Answer 1

0

The answer is simple: do not use sanitize_html_class. Take the input as it is (you can still do basic validation like length, making sure it is an integer only etc) and if you need to output that on the front and you don't trust the user who stored the data either use something like esc_html or wp_strip_all_tags depending on your needs. Of course, you can use wp_strip_all_tags when processing the meta data too but how confused will the user be when noticing the content isn't the same after saving the post? For this reason you may want to add a notice to not include any HTML tags.

As a side note, if you actually go ahead and add a custom field with the built-in WordPress mechanism you will see that it doesn't strip anything, a value is stored as it is.

Since you're still having troubles, here is your code a bit refactored:

function city_save_meta( $post_id, $post ) {
    if ( !isset( $_POST['city_nonce']) || !wp_verify_nonce( $_POST['city_nonce'], basename(__FILE__) ) )
        return $post_id;

    $post_type = get_post_type_object( $post->post_type);

    if ( !current_user_can( $post_type->cap->edit_post, $post_id ) )
        return $post_id;

    $new_meta_value = isset( $_POST['city_id'] ) ? $_POST['city_id'] : '';

    $meta_key = 'city_id';

    $meta_value = get_post_meta( $post_id, $meta_key, true );

    if ( ! empty( $new_meta_value ) ) {
        update_post_meta( $post_id, $meta_key, $new_meta_value );
    } else {
        /* Do you really expect to have multiple meta keys named exactly the same ('city_id')? */
        /* If you don't, you can skip the third parameter from 'delete_post_meta'. */
        delete_post_meta( $post_id, $meta_key, $meta_value );
    }
}
3
  • Hi! I both tried to take the input as they is, and to use esc_html. But then also saving/updating does'nt work. If lets say the current value is "LondonCity" I then change it to "Central New York" and click "Update". The message "The post is now updated" shows up. But the value is still "LondonCity". Am I missing something?
    – Alex
    Commented Aug 23, 2015 at 7:31
  • I took your code and copy/past it in to my functions file. But I gives me the same problem... (values does'nt update)
    – Alex
    Commented Aug 23, 2015 at 7:59
  • I am an idiot! esc_html is working. It was just me wo tried to change in the wrong form... Thanks alot! :)
    – Alex
    Commented Aug 23, 2015 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.