I have two fields. The first is for plain text (but with special characters) and the second for html content (wp_editor is used). Both are later needed for phpmailer.

<textarea style="width:100%;height:200px;" name="doi-altbody"><?php echo $epn_doi_altbody; ?></textarea>

wp_editor( $epn_doi_body, 'doi-body', array( 'editor_height' => '300px' ) );

1) How do i correctly secure them after submitting the form and then save them in the database into a custom table that already exist? (esc_attr, sanitize_text_field ...)

2) And when i want to output the content from the database in the exact and original typed version: How do i make this? (wpautop ...)

I have tried a few things in the last days. But it never worked as i needed.

2 Answers 2

  1. Just use the wpdb insert and update API, no escaping or sanitizing needed as per the doc, just the raw data.

Data: (array) Data to replace (in column => value pairs). Both $data columns and $data values should be "raw" (neither should be SQL escaped).

Something like:

      $wpdb->prefix . "myTable",
        "doiBody" => $_POST['doi-body']
      array( "%s" )
  1. No wpautop use is needed if you are outputting into the wp_editor textarea, just an esc_attr( $output ) would be sufficient I believe.

Hope this helps somehow.

  • The output goes directly to phpmailer as i wrote in my question. And if i do it this way quotes are going to be displayed as "&quot;" in the email from the textarea-version. And in the wp_editor version all the text has no line breaks and is in one line. The last problem is fixed when i use wpautop when giving the content to phpmailer. Commented Nov 6, 2016 at 1:13
  • I got it. I had to use on the textfield-version: wp_specialchars_decode( $text, $quote_style = ENT_QUOTES ) Commented Nov 6, 2016 at 1:24
  • You should sanitize the input at the very least. Could someone do a SQL injection attack here or is that only in other direct DB methods?
    – jgraup
    Commented Nov 6, 2016 at 16:49
  • @jgraup The post data is stored into a variable and goes than directly into the database. Also the form is only available in the admin area from the plugin (not a public form). And of course: No direct access to the files is possible. Commented Nov 6, 2016 at 19:52
<textarea style="width:100%;height:200px;" name="doi-altbody"><?php echo $epn_doi_altbody; ?></textarea>

wp_editor( $epn_doi_body, 'doi-body', array( 'editor_height' => '300px' ) );

To get the same result that was saved to the database the output has to be modified.

For the textarea:

wp_specialchars_decode( $epn_doi_altbody, $quote_style = ENT_QUOTES )

For the wp_editor:

wpautop( $epn_doi_body );
  • Can you provide additional code? I'm not doing something right. In my form, I have the wp_editor where an admin can enter the text. They might link to a document in the media or perhaps an another resource. When the content is saved, everything has <img class=\"size-full wp-image-174 alignleft\" src=\"http://localhost:8888/sandbox/wp-content/uploads/2017/11/user4.jpg\" alt=\"\" width=\"80\" height=\"80\" /> Some Text goes <a href=\"http://www.google.com\">here</a>. so when I output it, the image doesn't show and the URL shows up as http://localhost:8888/http://www.google.com. Any advice?
    – HPWD
    Commented Jun 17, 2018 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.