What kinds of data sanitization I have to do if I make a front end login and registration system for wordpress users?

  1. For login function wp_signon() should I escape the data for possible sql injection or wordpress will automatically do it for me?
  2. For registration I have found two function so far wp_insert_user() and wp_create_user() and for updating user wp_update_user()

For the registration function I think wp_create_user() will do the job for me. Again how much sanitization should i do?

Do i need to do the password hashing?

Also i have found some filters on the function reference page of the wp_create_user(). Those are pre_user_user_pass, pre_user_user_login, pre_user_user_nicename etc. Do, I need to use those filter before insert a new user?

1 Answer 1


You can check my tutorial for front-end user registration and login in WordPress: http://www.cozmoslabs.com/1012-wordpress-user-registration-template-and-custom-user-profile-fields/

As to the wp_signon, wp_insert_user, wp_create_user and wp_update_user they take care of all sanitation and validation of your content.

Also you don't need to use those filters in wp_create_user to create your users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.