Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?

Question

I'm writing a plug-in that stores UNIX datetimes in browser cookies and that also uses a $_POST variable based on a simple form that sends the ID number of the current WordPress post.

After reading several articles and posts on sanitization and validation in WordPress and PHP, I haven't found any that deal much or at all with handling cookie data in this way, though I have read statements (at this very site) seeming to suggest that a simple $_POST variable set programmatically via a hidden field probably wouldn't need to be validated or escaped.

THE COOKIES

Using JSON, the plugin sets and decodes the three cookies, all of which contain simple arrays with the Post-ID as key and the UNIX datetime as value. In addition to being compared to each other in conditionals, the datetimes are sometimes converted and displayed.

Now, on NetBeans, I get a "Do Not Access Superglobal COOKIE Array Directly" warning every time the code uses the COOKIE variable, even when I'm just checking whether it's set, as follows:

if (isset($_COOKIE['new_session'])) {
    //stuff
}

(Yes, I'm aware that you can also enable $_SESSION for WordPress if you want to via plug-in or other code - I decided against that route, but could still be persuaded to change my mind if someone gives me a reasons to do so!)

I also get the warning when I extract the data - for instance here:

$prev_visit = json_decode( stripslashes( $_COOKIE['prev_visit'] ), true );

EDIT: The UNIX datetime is accessed as a value from the resultant $prev_visit array. So, to get the datetime, we use $prev_visit[$id], with $id being the WP Post-ID number derived either directly or indirectly (in the second case via $_POST variable as below) from get_the_ID(), and serving as key.

THE POST VARIABLE

As for the $_POST data, it's created, as I said, via a simple form: User presses a button, hidden input sends Wordpress Post ID number as the "mark-all-read" value. Key lines:

$id = get_the_ID();

and, within the PHP creating the button/form:

$mark-all-read-button .= '<input type="hidden" name="mark-all-read" value="' . $id . '" />';

On the next refresh (action added to "init'), we check if 'mark-all-read' is set, and, if it is, we use the $id to set keys for the above-mentioned cookies [EDIT:] as in the more general example above. (This is what I meant by "indirectly" using the ID# derived via get_the_ID().)

I don't know if this was the best way to go about achieving my objectives in this plug-in, but it works pretty well so far. Before I share it with the world, however, I want to know whether it's safe to use.

THE QUESTION

So, do we need to validate and/or sanitize superglobals as used above, and, if so, how exactly?

Answer 1

Without reading the question, just from the title, the answer is YES. Any input from the outside world should be validated and sanitized where appropriate, and this include inpude the server recieves the fact that it might have been generated in a form you designed is irrelevant. Input should never be trusted.

Now about internal consistency. After you already validate and sanitized the input fields you should check that the data makes sense in the context you expect to handle it. If you expect a post id of a post then you need to check not only that it actually exists but also that it is not a page. This is really just another aspect of validation... and the sooner you do it in your code path and more detailed your error message is the easier your life will be.

So how exactly to do it? There is no recipe, different contexts require different validation and sanitation. It is probably better to start as strict as you can and then relax checks only if you have too.