0

In my sanitizing script, prior to using the POST Request method to submit this data, I have the following for my textarea input field named 'contact_msg':

if($_POST['contact_msg'] != ''){
      $contact_message = sanitize_textarea_field($_POST['contact_msg']);
      if(strlen($contact_message < 15)){
           $errors .= 'Please enter more information in your message.';
           $hasError = true;
      } elseif {strlen($contact_message > 2000)) {
           $errors .= 'Please shorten your message.';
           $hasError = true;
      }
 }

I'm a little tripped up because I don't think the key/value pair for $_POST['contact_msg'] would be sanitized–only the variable, $contact_message which by default isn't what is getting passed on submit, thus requiring me to do something else before passing the key/value pair for this input on submit? In other words, how do you actually sanitize $_POST['contact_msg']? Do you just add something like:

if($_POST['contact_msg'] != ''){
      $contact_message = sanitize_textarea_field($_POST['contact_msg']);
      if(strlen($contact_message < 15)){
           $errors .= 'Please enter more information in your message.';
           $hasError = true;
      } elseif (strlen($contact_message > 2000)) {
           $errors .= 'Please shorten your message.';
           $hasError = true;
      } else {
           $_POST['contact_msg'] = sanitize_textarea_field($_POST['contact_msg'];
      }

 }

in order to actually sanitize the data being posted?

|improve this question
0

First check that it's not empty, then typecast to a string value as a security precaution, because it's always possible for this to be submitted as an array; e.g., by an attacker. Then unslash, sanitize, and continue by checking length and anything else that you'd like to validate.

if ( ! empty( $_POST['contact_msg'] ) ){
    $contact_message = (string) $_POST['contact_msg'];
    $contact_message = wp_unslash( $contact_message );
    $contact_message = sanitize_textarea_field( $contact_message );
}

Tip: Also be sure to verify the request using an Nonce.

Here's a more terse variation of the above.

if ( ! empty( $_POST['contact_msg'] ) ){
    $contact_message = sanitize_textarea_field( wp_unslash( (string) $_POST['contact_msg'] ) );
}
|improve this answer
  • so what technically gets passed in form submit in the HTTP Body? Is it the string value (cleaned) for $contact_message? Or is it the original input for $_POST['contact_msg'] providing it passes validation? Do I need to set $_POST['contact_msg'] to $contact_message for it to submit the cleaned value to the HTTP Body that goes on to my form action? This is what I'm having difficulty understanding. – nrstx Nov 16 '17 at 16:00
  • No. It's better to think of $_POST as a read-only array and treat it that way. The current $_POST array shows you what data was submitted, which you can never trust. So what you're doing is cherry-picking the data that you're expecting to receive from $_POST, sanitizing it, and storing it into a local variable by the name of $contact_message. From that point on, you should only work with $contact_message and forget about $_POST['contact_msg']. – jaswrks Nov 16 '17 at 19:31
  • $_POST['contact_msg'] presumably contains the unsanitized 'contact message field' from your form. You can't trust that it does, because a POST method could come from anywhere and contain anything. Normally it comes from your form, but that's why you sanitize it, just to be safe. And even still, depending on how much sanitizing you do, it's still important to realize that you can never be certain of what $_POST contains. That comes from the user, an untrusted source. So always treat with care; i.e., don't just echo it out onto a page. Escape it first; e.g., esc_html(). – jaswrks Nov 16 '17 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.