in an example of the Settings API, there's an input and the callback function to sanitize/validate the result from this input :

this is the input :

echo "<input id='text_string' name='boj_myplugin_options[text_string]' type='text' value='$text_string' />";

and this is the callback function :

function boj_myplugin_validate_options( $input ) {
    $valid['text_string'] = preg_replace( '/[^a-zA-Z]/', '', $input['text_string'] );

i read that this function is passed the $_POST data as a parameter, but what does text_string stand for here : $input['text_string'] ?

i'm a bit confused, it should be the name parameter, but the name parameter seems to be a plain text : name='boj_myplugin_options[text_string]'

Thanks for your answer

1 Answer 1


You sanitization callback function get passed all the values that correspond with the setting name. When a POST request is made to the options.php file from the page on which your settings resides, WordPress calls your sanitization callback in a way that would resemble this:

boj_myplugin_validate_options( $_POST['boj_myplugin_options'] );

Notice that the name attribute looks mysteriously like indexing an associative array: boj_myplugin_options[text_string].

This sets up $_POST['boj_myplugin_options'] as an array. But, as you can see above, WordPress doesn't pass the entire $_POST array into your sanitization callback: it just passes the values related to your plugin. Doing it this way allows you to store multiple values in the same option. You don't always do that, but it's fairly common.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.