The general guideline is that we should sanitize all user input before using them.

Now my questions is whether this applies to nonce or not.

Which one is correct?

wp_verify_nonce( sanitize_text_field( $_GET['some_nonce'] ), 'some_nonce' );


wp_verify_nonce( _GET['some_nonce'], 'some_nonce' );

  • Relevant issue at github/WordPress/WordPress-Coding-Standards. TLDR: It's not necessary as explained by Fayaz below; but if your environment is throwing warnings because of the unsanitized $_REQUEST then use sanitize_key()
    – brasofilo
    Jan 16, 2021 at 19:36

1 Answer 1


Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.

wp_verify_nonce function checks $nonce value like this:

if ( hash_equals( $expected, $nonce ) ) {
    return 1;

For this you don't need sanitizing. So the following is fine:

wp_verify_nonce( $_GET['some_nonce'], 'some_nonce' );
  • 2
    Note that this should check isset( $_GET['some_nonce'] ) first to avoid an error if the query string arg is not there.
    – butlerblog
    Dec 27, 2022 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.