I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using
wp_kses except HTML tags.
However, I'm new to development and would like to be confirmed that I'm going to right place.
Now, I'm creating user submitting frontend form.
There are several input fields,
1) Post title, type: text, sanitize method I've used:
sanitize_text_field( $_POST['post_title'] )
2) Post content, type: textarea, sanitize method I've used: None, because of allowed html tag, for example,
<img> I do not sanitize.
wp_insert_post will sanitize tags except allowed html tags.
3) URL, type: URL, sanitize method I've used:
esc_url( strtok( 'url, '?' )); //Strip query string and sanitize.
4) Coupon code, type: text, sanitize method I've used:
sanitize_text_field( $_POST['coupon'] )
5) Price, type: text, sanitize method I've used:
sanitize_text_field( $_POST['price'] )
6) Image file(Thumbnail) type: file, sanitize method I've used:
sanitize_file_name( $_POST['file']['name'] )
7) Category, type: int, sanitize method I've used: None, but validate whether the value is int or not using
absint(), or type setting
Is there anything else that I have to concern more?
I would like to know the way to secure my website.
The formal document recommend to use
wp_strip_all_tags in post title field, however, I just use sanitize_text_field. Actually, I don't know the difference between
sanitize_text_field has more security features than
wp_strip_all_tags, but in the light of the official documentation,
wp_strip_all_tags is enough for sanitizing. Am I right?
Any tips are appreciated. Thank you in advance! :)