I find Data Validation page on Codex a bit confusing. It highlights what all functions do but not how one differs from another and which one should be the right choice in a particular use case.

Like earlier, Rarst created an awesome chart to show the difference between WP_Query, query_posts(), get_posts() and it was so much easy to understand the difference among them & I could point anyone to that chart to make them understand the difference.

Examples of different validation functions will help developers understand them better and not leave them confusing to an extent. Having it sounds like a good idea?

  • The codex leaves much to be desired for sure. I'm in agreement there. What is your question?
    – tollmanz
    Commented Aug 13, 2011 at 22:00
  • There are 3-4 functions which says, they will encode <> and the only difference mention is that some won't double encode them. My main question is to clarify the differences & their appropriate usage better in terms of consideration of different use cases. In short, examples with explanations :-) I am not sure how we can do it here but we can make some progress for sure.
    – Ashfame
    Commented Aug 13, 2011 at 22:39
  • I'd be happy to take a look at it, as well as others, but can you ask a more specific question? There looks to be over 30 functions there and I'm not sure which ones you are having trouble with? Let us know and I'm sure someone will be happy to assist.
    – tollmanz
    Commented Aug 13, 2011 at 23:05

1 Answer 1


I think the common issue (that I myself have at times) with understanding data validation that we try to approach it as function-centric (which one to use), while it should be approached as process:

  • where data comes from
  • where it goes
  • what unwanted and/or harmful things it might include

The confusing amount of function comes from abundance of possible combinations and still won't cover all possibilities. While sanitization is covered, validation is usually something to you code yourself in context of your data.

The nature of data is different. Number is different from URL and from text and from HTML code and from user name, etc.

The purpose of sanitization is different. Data, going into database, is sanitized mostly to prevent SQL exploits. Data, going to screen, is sanitized mostly to prevent harmful JavaScript from running.

So while there are confusingly many functions, there is no simple logic to using them. That logic entirely depends on your specific data. You need to:

  1. understand general security concepts
  2. then your data
  3. then context of input or output
  4. and only then you have enough understanding to start picking functions to use

For solid overview of security basics in WordPress I recommend watching Theme & Plugin Security by Mark Jaquith.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.