0

Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?

  • No, that answer explains what these functions do, but i want to understand what makes me sanitize an email which been considered valid after using is_email – Makiomar Aug 7 '19 at 21:24
  • I have rewritten the question – Makiomar Aug 7 '19 at 21:30
  • You should sanitize any data being added to the DB. For more specific feedback, explain what you're doing with the email address. I agree that the answer to the question referenced by Antii covers this topic. – Dave Romsey Aug 7 '19 at 21:34
2

Regarding the edited question, here's another old Q&A, which might actually be a better reference, Should I sanitize an email address before passing it to the is_email() function?, especially @kaiser's answer.

And regarding kaiser's Funny sidefact now as I had a look at the sources for both functions (is_email(), sanitize_email()), they are indeed basically the same.

So to quote @Howdy_McGee's answer,

I would even go so far as to say that if this function returns true, you wouldn't need to sanitize it before sending it into the database.

But he also notes in the comments about using the sanitize function,

...better safe than sorry and the sanitization overhead would be entirely unnoticeable.

So based on these, I'd say that it is not strictly necessery to use sanitize_email() after is_email() returns truthy value (the email). You could use it maybe out of habbit or consistency of sanitizing everything before saving stuff to the database (if, that is what you're going to do with the email).

  • Thank you, now clear – Makiomar Aug 8 '19 at 10:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.