Everything is in the question.

For a notices system to show warnings/errors in the admin, I´m using transient.

When I published my first plugin, I received an email to ask me to sanitize/validate/escape data which inserts in database so...

I´m doing a function to wrap set_transient() to do this but I´m not sure if in this case is necessary. Wordpress should do this.


function secure_set_transient( string $transient_name, $value ) {
    $f_transient_name = maybe_serialize( esc_attr( sanitize_key( $transient_name ) ) );
    $f_value = ( !is_scalar( $value ) ) ? maybe_serialize( $value ) : esc_attr( sanitize_text_field( $value ) );
    return set_transient(  $f_transient_name, $f_value );
  1. Is it necessary to use esc_attr(), sanitize_key() and sanitize_text_field()?

  2. Do I serialize the non-scalar value?

Everything works if I don´t serialize the array value. When I use maybe_serialize(), the data as array is serialized but continue to be a serialzed string when I use get_transient(). When I inspect the wordpress core, I can see it´s never serialized but on the top of the function set_transient(), it´s written : @param mixed $value Transient value. Must be serializable if non-scalar. I´m a bit confused. What I suppose to do ?

  • If you aren’t using a persistent object cache, then the options API handles the saving of the transient – Milo Jul 21 '18 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.