I have created a form to insert posts via front-end to users.

I use wp_insert_post function.

Should I worry about SQL injection or Does wp_insert_post function handle it?

1 Answer 1


WordPress DOES take care of SQL injection and for you. See the Security section on this page. The wp_insert_post() function runs through sanitize_post().

Be aware that malicious or unintended code can still be inserted:

"You may wish, however, to remove HTML, JavaScript, and PHP tags from the post_title and any other fields. Surprisingly, WordPress does not do this automatically. This can be easily done by using the wp_strip_all_tags() function and is especially useful when building front-end post submission forms."

Should you not want to strip ALL tags, Validating Sanitizing and Escaping User Data is a good page to start looking for specific sanitation rules that are built in. You can never be too secure.

  • I am assuming "SQL injection" is ANY insecure data from untrustworthy users. Commented Mar 23, 2016 at 3:36
  • 1
    I think the answer is confusing, you start with a wrong answer and then correct yourself. Maybe a total rewrite which will describe in a little more orgenized way what core will do and what it will not is in order ;) Commented Mar 23, 2016 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.