5

I have a custom post form that sends data to a page which uses wp_insert_post to create a post. I can easily sanitize most data, but I have some troubles with my tags, I retrieve in an array:

$tags =  $_POST['tags'];

Before using these tags as tags_input, how can I successfully sanitize all names?

Thanks!

18

Here's a way to do it with PHP's array map function:

// Good idea to make sure things are set before using them
$tags = isset( $_POST['tags'] ) ? (array) $_POST['tags'] : array();

// Any of the WordPress data sanitization functions can be used here
$tags = array_map( 'esc_attr', $tags );
2

If anyone is interested, I solved it like this:

        $tags = $_POST['tags'];
        if (count($tags) > 5){
            echo 'Niet meer dan 5 tags';
            $stop = true;
        }

        if (is_array($tags)) {
            foreach ($tags as &$tag) {
                $tag = esc_attr($tag);
            }
            unset($tag );
        } else {
            $tags = esc_attr($tags);
        }
0

I needed a recursive sanitation, so here's my solution:

/**
 * Recursive sanitation for an array
 * 
 * @param $array
 *
 * @return mixed
 */
function recursive_sanitize_text_field($array) {
    foreach ( $array as $key => &$value ) {
        if ( is_array( $value ) ) {
            $value = recursive_sanitize_text_field($value);
        }
        else {
            $value = sanitize_text_field( $value );
        }
    }

    return $array;
}
  • What't that & before $value for? – Daniel Jun 23 '18 at 8:13
  • When you iterate an array in a foreach statement, it works on a copy of that array. so if you really want to modify $value, you have to add & before it. see stackoverflow.com/questions/3307409/… – Broshi Jun 23 '18 at 20:09
0

You can use this function for almost all cases.

/**
 * Recursive sanitation for text or array
 * 
 * @param $array_or_string (array|string)
 * @since  0.1
 * @return mixed
 */
function sanitize_text_or_array_field($array_or_string) {
    if( is_string($array_or_string) ){
        $array_or_string = sanitize_text_field($array_or_string);
    }elseif( is_array($array_or_string) ){
        foreach ( $array_or_string as $key => &$value ) {
            if ( is_array( $value ) ) {
                $value = sanitize_text_or_array_field($value);
            }
            else {
                $value = sanitize_text_field( $value );
            }
        }
    }

    return $array_or_string;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.