wordpress sanitize array?

Question

I have a custom post form that sends data to a page which uses wp_insert_post to create a post. I can easily sanitize most data, but I have some troubles with my tags, I retrieve in an array:

$tags =  $_POST['tags'];

Before using these tags as tags_input, how can I successfully sanitize all names?

Thanks!

Answer 1

Here's a way to do it with PHP's array map function:

// Good idea to make sure things are set before using them
$tags = isset( $_POST['tags'] ) ? (array) $_POST['tags'] : array();

// Any of the WordPress data sanitization functions can be used here
$tags = array_map( 'esc_attr', $tags );

Answer 2

I needed a recursive sanitation, so here's my solution:

/**
 * Recursive sanitation for an array
 * 
 * @param $array
 *
 * @return mixed
 */
function recursive_sanitize_text_field($array) {
    foreach ( $array as $key => &$value ) {
        if ( is_array( $value ) ) {
            $value = recursive_sanitize_text_field($value);
        }
        else {
            $value = sanitize_text_field( $value );
        }
    }

    return $array;
}

Answer 3

If anyone is interested, I solved it like this:

        $tags = $_POST['tags'];
        if (count($tags) > 5){
            echo 'Niet meer dan 5 tags';
            $stop = true;
        }

        if (is_array($tags)) {
            foreach ($tags as &$tag) {
                $tag = esc_attr($tag);
            }
            unset($tag );
        } else {
            $tags = esc_attr($tags);
        }

Answer 4

You can use this function for almost all cases.

/**
 * Recursive sanitation for text or array
 * 
 * @param $array_or_string (array|string)
 * @since  0.1
 * @return mixed
 */
function sanitize_text_or_array_field($array_or_string) {
    if( is_string($array_or_string) ){
        $array_or_string = sanitize_text_field($array_or_string);
    }elseif( is_array($array_or_string) ){
        foreach ( $array_or_string as $key => &$value ) {
            if ( is_array( $value ) ) {
                $value = sanitize_text_or_array_field($value);
            }
            else {
                $value = sanitize_text_field( $value );
            }
        }
    }

    return $array_or_string;
}