When writing code that accepts input from users I always sanitize data one variable at a time.


$title = wp_strip_all_tags($_POST['title']);
$content = wp_strip_all_tags($_POST['content']);

I had the idea of simplifying things by sanitizing everything at once, inside a loop:

foreach ($_POST as $key => $value) $_POST[$key] = wp_strip_all_tags($value);

When something more specific is needed, I may later add

if (!is_email($_POST['email'])) die();

Do you think this is a good approach, given that I won't be accepting html tags in this case?

Am I safe from sql injection attacks or some other sort of maliciusness?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.