My question is about sanitizing user input data before using it. I am not very experienced in neither PHP or this sanitizing subject so I apologise in advance if this question might come across as dumb.

I have created a very simple search formular for a website, that allows a visitor to search after some custom posts types by different fields. The search form sends some strings by GET request and the data is then processed in a pre_get_posts where I alter the $query object. Right now I use no sanitisation at all: I directly use get_query_var( 'var1' ) to alter the query. So my question is this: is this OK, is it safe? Can I just use a string from a GET request directly like this or should i perform some sanitisation on it before using and in that case - which functions should i use to "clean" it.

Please remember, that I a COMPLETE beginner on this subject so please remember this in your answer. And also please remember that I have tried to read other threads on Stackoverflow on this very subject but to be honest - they have almost left me more confused than before I began. I know from reading these threads, that you have to sanitise the data according to how you plan to use the data. In my case that is as explained - to use it to create the post query from the GET requests.

Thanks in advance!

EDIT: Just to tell a little bit more about the data send by the GET request. My search form consists of some drop down menus with preconfigured strings. So I of course dont accept any HTML code in the request data. I have found the functions htmlspecialchars and filter_var($str, FILTER_SANITIZE_STRING), but are these enough to sanitize the string and do they accomplish the same?

  • There is a good page about sanitization on wordpress.org website. List of functions you can use in wordpress to secure data you recieve. Prefer to use them, as they already build in wordpress, and wordpress uses them not only for sanitize GET/POST data, but sanitize data recieved from database. So it's more native way to secure data I think. But of course it will be secure if you do it by yourself too (Check for invalid UTF-8, strips all tags, strips octets etc). developer.wordpress.org/themes/theme-security/… – anton May 4 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.