2

I have two fields. The first is for plain text (but with special characters) and the second for html content (wp_editor is used). Both are later needed for phpmailer.

<textarea style="width:100%;height:200px;" name="doi-altbody"><?php echo $epn_doi_altbody; ?></textarea>

wp_editor( $epn_doi_body, 'doi-body', array( 'editor_height' => '300px' ) );

1) How do i correctly secure them after submitting the form and then save them in the database into a custom table that already exist? (esc_attr, sanitize_text_field ...)

2) And when i want to output the content from the database in the exact and original typed version: How do i make this? (wpautop ...)

I have tried a few things in the last days. But it never worked as i needed.

0
  1. Just use the wpdb insert and update API, no escaping or sanitizing needed as per the doc, just the raw data.

Data: (array) Data to replace (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped).

Something like:

    $wpdb->insert(
      $wpdb->prefix . "myTable",
      array(
        "doiBody" => $_POST['doi-body']
      ),
      array( "%s" )
    );
  1. No wpautop use is needed if you are outputting into the wp_editor textarea, just an esc_attr( $output ) would be sufficient I believe.

Hope this helps somehow.

  • The output goes directly to phpmailer as i wrote in my question. And if i do it this way quotes are going to be displayed as "&quot;" in the email from the textarea-version. And in the wp_editor version all the text has no line breaks and is in one line. The last problem is fixed when i use wpautop when giving the content to phpmailer. – wassereimer Nov 6 '16 at 1:13
  • I got it. I had to use on the textfield-version: wp_specialchars_decode( $text, $quote_style = ENT_QUOTES ) – wassereimer Nov 6 '16 at 1:24
  • You should sanitize the input at the very least. Could someone do a SQL injection attack here or is that only in other direct DB methods? – jgraup Nov 6 '16 at 16:49
  • @jgraup The post data is stored into a variable and goes than directly into the database. Also the form is only available in the admin area from the plugin (not a public form). And of course: No direct access to the files is possible. – wassereimer Nov 6 '16 at 19:52
0
<textarea style="width:100%;height:200px;" name="doi-altbody"><?php echo $epn_doi_altbody; ?></textarea>

wp_editor( $epn_doi_body, 'doi-body', array( 'editor_height' => '300px' ) );

To get the same result that was saved to the database the output has to be modified.

For the textarea:

wp_specialchars_decode( $epn_doi_altbody, $quote_style = ENT_QUOTES )

For the wp_editor:

wpautop( $epn_doi_body );
  • Can you provide additional code? I'm not doing something right. In my form, I have the wp_editor where an admin can enter the text. They might link to a document in the media or perhaps an another resource. When the content is saved, everything has <img class=\"size-full wp-image-174 alignleft\" src=\"http://localhost:8888/sandbox/wp-content/uploads/2017/11/user4.jpg\" alt=\"\" width=\"80\" height=\"80\" /> Some Text goes <a href=\"http://www.google.com\">here</a>. so when I output it, the image doesn't show and the URL shows up as http://localhost:8888/http://www.google.com. Any advice? – HPWD Jun 17 '18 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.