I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some security issues.

I don't Know How to fix it

## Data Must be Sanitized, Escaped, and Validated

contador2022/wp_mvpcounter.php:240: $ua = $_SERVER['HTTP_USER_AGENT'];

## Variables and options must be escaped when echo'd

contador2022/manage/admin.php:460: <?php echo $query_today;

## Generic function/class/define/namespace names

contador2022/wp_mvpcounter.php:12:class PostViewsStats

Thanks in advance.


1 Answer 1


You should check the Plugin Security section in the plugin developer's handbook.

1) Data Must be Sanitized, Escaped, and Validated

Validation – These are the checks that are run to ensure the data you have is what it should be. For instance, an e-mail looks like an e-mail address, that a date is a date, and that a number is (or is cast as) an integer.

Sanitization / Escaping – These are the filters that are applied to data to make it 'safe' in a specific context. For instance, to display HTML code in a text area it would be necessary to replace all the HTML tags by their entity equivalents

Before : $ua = $_SERVER['HTTP_USER_AGENT'];

After : $ua = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';

2) Variables and options must be escaped when echoing

When you are going to print any content as output and if you did not properly escape it then will generate an error and will say Output should be run through an escaping function. Check out more functions here

Before: echo $query_today;

After : echo esc_html( $query_today );

3) Generic function/class/define/namespace names

All plugins must have unique function names, namespaces, defines, and class names. This prevents your plugin from conflicting with other plugins or themes. You can add your unique prefix or suffix to every function and class name.

Before: class PostViewsStats

After: class GunviperPostViewsStats

  • I get Parse error: syntax error, unexpected ';', expecting ',' or ')' $ua = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
    – gunviper
    Nov 30, 2022 at 13:38
  • It works perfectly in my editor. Nov 30, 2022 at 13:42
  • Your editor may need to be reloaded. There is a possibility that the error originated elsewhere. Nov 30, 2022 at 13:51
  • thank you very much, works
    – gunviper
    Nov 30, 2022 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.