I've been doing a lot of research and had several discussions in chat about learning to take a JSON feed and add the content to a post in WordPress.

In the past I would create a page template and through the setting's admin panel create a form field for a particular API's key and when the template was used it would call the JSON into a folder and loop through the results on a single page with links to the site it originated from. Now I would like to learn how take the JSON and add it to the database to be used in a post.

Research and discussions in chat have resulted several tutorials and Q&As on the subject such as:

Importing the data I was able to find:

However, I've always been taught when inputting data it should always be considered as bad input and should be tested and cleaned. When researching on sanitizing input I did run across:

Though I didn't really see anything discussing if JSON should be sanitized and when I was looking for a hook I didn't see anything. So this leads me to my question. When calling a JSON feed from a third party source should the JSON be sanitized before adding it to the database and if so does WordPress have a built in way to do it? When I researched sanitize JSON I didn't find anything built in WordPress that could sanitize the JSON.

1 Answer 1


There are two aspects here

  1. obviously all input should be sanitized
  2. JSON is just a wrapper no different then any other type of container which is used to aggregate data for transmission. You almost never sanitize the container as usually in case of an error you will just not be able to extract the data from it, but each piece of data should be sanitized. Since sanitization depends on context it is just impossible to have a generic rules that can be applied to all data in all the possible contexts.

So you need to do sanitization, but can you just trust core API to do it for you? It again depends on context. If you just need the data to be stored in the DB without breaking anything then the DB access APIs will do everything for you, but if you have to have the content of a post be XHTML complient then you will have to write your own validation.

In one line: Always sanitize input as much as possible. Once everything is sanitized on the "data model" level, you can trust wordpress API to not generate additional gotca moments.

  • What i had planned was to create custom fields and meta boxes and store the post as a draft and possibly modify the publish aspect to run validation on the custom fields and meta boxes but I guess i will have to create validation on the JSON decode aspect before assigning it to an array but that is ehat Ive gathered
    – user9447
    Commented Jul 6, 2016 at 20:46
  • well, json_decode will fail if the json is not properly formatted, but you probab;y want to check first that you actually have all the data you expect to have. If you just get textual data then there isn't much validation to do, and the amount of validation you *"have to do" is smaller if you can trust the source. In most scenarios where validation is discussed it is of an external unsolicited input Commented Jul 7, 2016 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.