1

My code is like that

$wp_customize->add_setting(
    'scroll_logo',
    array(
        'default'           => '',
        'capability'        => 'edit_theme_options',
        'sanitize_callback' => 'esc_attr',
    )
);
$wp_customize->add_control( new WP_Customize_Cropped_Image_Control( $wp_customize, 'scroll_logo', array(
    'section'       => 'title_tagline',
    'label'         => __( 'Upload Scroll Logo', 'bar-restaurant' ),
    'description'   => __( 'Logo Size (120 * 60)', 'bar-restaurant' ),
    'flex_width'    => true,
    'flex_height'   => true,
    'width'         => 120,
    'height'        => 50,
    'priority'      => 19,
    'default-image' => '',
) ) );
  • 1
    what is actually the quesion? why do you need to sanitize at all? – Mark Kaplun Oct 7 '17 at 6:23
1

It's always a good idea to sanitize values being accepted from the user. A WP_Customize_Cropped_Image_Control will populate its associated setting with an attachment ID. Thus you could use absint as the sanitizing function.

Remember that esc_attr is an escaping function and should only be used when printing out a value to the page, and here particularly in an HTML attribute. Note also that esc_url_raw() is not an escaping function, despite its name, but rather is actually a sanitizing function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.