Wanting to learn more about the settings page I wanted to be able to add code such as Google Adsense, Google Analytics and anything code related in a textarea within a custom settings page but I've been unable to track down a previous Q&A.

Upon research I've run across "Default Wordpress settings API data sanitization" which indicated WordPress doesn't do any data sanitation outside of the default. When I research further I've come across The WordPress Settings API, Part 7: Validation, Sanitisation, and Input which shows to use sanitize_text_field() and then referenced Validating Sanitizing and Escaping User Data but that is only on the index.php on output if I'm understanding correctly. Further searching I found "Proper Way To Sanitize And Validate Options When Using The Settings Api?" which only recommended a few other links that didn't answer my question.

When I'm using a textarea in my settings page:

function curious_darth() { 
    $question_dark_side = get_option('darth_vader');
    <textarea rows="12" cols="60" type='text' name='darth_vader[light_saber]' value='<?php if (isset($question_dark_side['light_saber']) ) echo sanitize_text_field($question_dark_side['light_saber']); ?>'><?php echo isset($question_dark_side['light_saber'] ) ? $question_dark_side['light_saber'] : false; ?></textarea>

Is there a way to sanitize the data on input so that on output it will not render and if I want it to render somewhere in particular what is the proper way to render text that has had it's HTML escaped?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.