I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is.

The first issue is when i'm verifying a nonce while saving metabox data:

$nonce = isset( $_POST['revv_meta_box_nonce'] ) ? $_POST['revv_meta_box_nonce'] : '';

The error i'm getting here is 'Processing data without nonce verification'. Which is pretty silly since i'm just storing the nonce in a variable, which I am then verifying on the next line.

The second issue is when i'm storing the data:

$foo = isset($_POST['foo']) ? sanitize_text_field( $_POST['foo'] ) : '';
update_post_meta( $post_id, '_foo', $foo );

On the first line there, the sniffer is complaining that i'm not running wp_unslash on the data before sanitizing it. But the data is going directly into update_post_meta on the next line, which expects that data to not be unslashed.

Any ideas on the best strategy for getting rid of these error messages? Thanks!

  • since metabox doesn't usually need to have a nounce, I would say that the requirement is idiotic (but that is what the codex show :( ), so your problem is with the VIP people and you should ask them, this is off-topic for this site. – Mark Kaplun Jan 16 '16 at 12:40
  • Agreed, can't see an issue with the first snippet. Second one, you do need to unslash (WordPress enforces magic quotes, bizarrely), and the *_post_meta functions do not expect the data slashed (it will be escaped at point of db insertion). – TheDeadMedic Jan 17 '16 at 19:09
  • @TheDeadMedic thanks, looks like I misread the docs on that one. – user1020189 Jan 24 '16 at 20:38

You can use filter_input to sanitize your $_POST array.

$nonce = filter_input( INPUT_POST, 'revv_meta_box_nonce', FILTER_SANITIZE_STRING )

use empty() to check $nonce has a value or not.

You can use the same for second issue

$foo = filter_input( INPUT_POST, 'foo', FILTER_SANITIZE_STRING )

change 3rd parameter as your data type in $_POST['foo']. check this doc for available filters.

  • 1
    this is abusing the limitations of the sniffer instead of fixing the problem. It makes more sense to just turn off the error for that line with a proper comment than hacking around in this way. Who knows, maybe one day the sniffer code will be improved to sniff behind filter_input – Mark Kaplun Jun 11 '18 at 12:54
  • VIP it self allow to use in this way as filter_input validate or sanitise your data. You only need to pass an appropriate filter for that. – Sagar Nasit Jun 11 '18 at 13:17
  • That is the problem of VIP for allowing bad input that is not properly unslashed, or otherwise sanitized. But I would guess that they allow it because they are not aware of it, not because it is correct code. – Mark Kaplun Jun 11 '18 at 16:18
  • actually seems like the 10up team and the authors of the sniffer are aware of the issue github.com/WordPress-Coding-Standards/… – Mark Kaplun Jun 11 '18 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.