I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or textareas that I pick up on post save, in the $_POST
variable, are put in the array, and saved in the post meta.
Now on post save I have standard
if ( defined('DOING_AUTOSAVE') && DOING_AUTOSAVE ){
return;
}
if ( !current_user_can('edit_post', $post_id) ){
return;
}
if ( !isset( $_POST['talk_fields_meta_box_nonce'] ) || !wp_verify_nonce( $_POST['talk_fields_meta_box_nonce'], 'talk_field_nonce' ) ){
return;
}
and then I set my array in which I add the inputs look like
$talk_title = $_POST['talk_title_'.$i];
$new_events[$i][$j]['talk_title'] = stripslashes( strip_tags( $talk_title ) );
for instance (I'm looping here, that's why I have $i
and $j
). This array is then added to a post meta, and when I look at it in my database, the value is saved as serialized array.
When I pull that info out to fill the metabox I am using either esc_attr()
, esc_html()
or wp_kses_post()
(for description in the textarea) as a sanitization.
What I am wondering is if I'm safe from any kind of attacks by not using htmlspecialchars
?
I mean, on save I'm checking if a user can edit the post, I have nonce check, and I'm escaping on output. Can my database be corrupted in any way - pasting something in a textarea and saving the post for instance? Or am I safe?
Thanks!
sanitize_text_field
for sanitizing non-textarea form inputs. It'll handle things like line breaks, invalid UTF-8, whitespace, octets etc. – TheDeadMedic May 3 '16 at 14:43sanitize_text_field
? Thanks! – dingo_d May 3 '16 at 15:20stripslashes( strip_tags( $talk_title ) )
usesanitize_text_field( wp_unslash( $talk_title ) )
– TheDeadMedic May 3 '16 at 15:21