Properly sanitize an input field "Name <[email protected]>"

Question

In my plugin I want administrators to be able to set the from name and email address in a single form field.

I anticipate the field content to be Name <[email protected]> However both sanitize_text_field() and sanitize_email() do their jobs and remove critical parts of the data.

Is there better way to do it rather than wp_kses()?

Answer 1

You could do something like this:

$input = 'Name <[email protected]>';

// Break the input into parts
preg_match( '/([^<]+)<([^>]+)>/i', $input, $matches, PREG_UNMATCHED_AS_NULL );

// Clean the name
$name = sanitize_text_field( $matches[ 1 ] );

// Clean the email
$email = sanitize_email( $matches[ 2 ] );

// Bail early if the values are invalid.
if ( !$name || !$email || !is_email( $email ) ) {
    die( 'Invalid input' );
}

// Success!
$cleaned_input = "{$name} <{$email}>";