I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or textareas that I pick up on post save, in the $_POST variable, are put in the array, and saved in the post meta.

Now on post save I have standard

    if ( defined('DOING_AUTOSAVE') && DOING_AUTOSAVE ){

    if ( !current_user_can('edit_post', $post_id) ){

    if ( !isset( $_POST['talk_fields_meta_box_nonce'] ) || !wp_verify_nonce( $_POST['talk_fields_meta_box_nonce'], 'talk_field_nonce' ) ){

and then I set my array in which I add the inputs look like

$talk_title = $_POST['talk_title_'.$i];
$new_events[$i][$j]['talk_title'] = stripslashes( strip_tags( $talk_title ) );

for instance (I'm looping here, that's why I have $i and $j). This array is then added to a post meta, and when I look at it in my database, the value is saved as serialized array.

When I pull that info out to fill the metabox I am using either esc_attr(), esc_html() or wp_kses_post() (for description in the textarea) as a sanitization.

What I am wondering is if I'm safe from any kind of attacks by not using htmlspecialchars?

I mean, on save I'm checking if a user can edit the post, I have nonce check, and I'm escaping on output. Can my database be corrupted in any way - pasting something in a textarea and saving the post for instance? Or am I safe?


  • 1
    Sounds like you're doing fine - but I would suggest using WP's sanitize_text_field for sanitizing non-textarea form inputs. It'll handle things like line breaks, invalid UTF-8, whitespace, octets etc. – TheDeadMedic May 3 '16 at 14:43
  • So on my input fields where I have title of the talk, name of the talkers etc. I should just use sanitize_text_field? Thanks! – dingo_d May 3 '16 at 15:20
  • Instead of stripslashes( strip_tags( $talk_title ) ) use sanitize_text_field( wp_unslash( $talk_title ) ) – TheDeadMedic May 3 '16 at 15:21
  • Great, seems to be working without a problem :) Thanks! – dingo_d May 3 '16 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.