The general guideline is that we should sanitize all user input before using them.

Now my questions is whether this applies to nonce or not.

Which one is correct?

wp_verify_nonce( sanitize_text_field( $_GET['some_nonce'] ), 'some_nonce' );


wp_verify_nonce( _GET['some_nonce'], 'some_nonce' );


Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.

wp_verify_nonce function checks $nonce value like this:

if ( hash_equals( $expected, $nonce ) ) {
    return 1;

For this you don't need sanitizing. So the following is fine:

wp_verify_nonce( $_GET['some_nonce'], 'some_nonce' );
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.