I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I was under the impression that I don't, since the documentation says that $meta_key and $meta_value should be raw.

Are there any other instances / WordPress features in a plugin wherein I will need to sanitize my data?

  • 4
    It's not the same question as yours, but Tom's answer to this question gives a great overview of santitising and escaping, the difference between them, and when you should use them. But just regarding your question: for those functions 'raw' means un-escaped, not un-sanitized. Whether and what sanitisation is appropriate depends on your data and how you use it. – Jacob Peattie Jul 30 '18 at 15:11