0

In my plugin I want administrators to be able to set the from name and email address in a single form field.

I anticipate the field content to be Name <[email protected]> However both sanitize_text_field() and sanitize_email() do their jobs and remove critical parts of the data.

Is there better way to do it rather than wp_kses()?

2
  • 1
    This isn't a better way, but if you must use a single field, and that the value will always be in that format, then you can split the value into 2 parts - the name and email address - then sanitize them separately.
    – Sally CJ
    Feb 9 at 8:47
  • 1
    Or you can use JavaScript to split the data and put them into hidden fields, then at the server-side, it'd be easy to sanitize the values before doing anything else..
    – Sally CJ
    Feb 9 at 8:59

1 Answer 1

1

You could do something like this:

$input = 'Name <[email protected]>';

// Break the input into parts
preg_match( '/([^<]+)<([^>]+)>/i', $input, $matches, PREG_UNMATCHED_AS_NULL );

// Clean the name
$name = sanitize_text_field( $matches[ 1 ] );

// Clean the email
$email = sanitize_email( $matches[ 2 ] );

// Bail early if the values are invalid.
if ( !$name || !$email || !is_email( $email ) ) {
    die( 'Invalid input' );
}

// Success!
$cleaned_input = "{$name} <{$email}>";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.