I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:

add_filter('name_save_pre', 'save_name');
function save_name($name_to_ignore) {
         global $post, $meta_box, $wpdb;

     $this_post_id = $post->ID;
         // verify nonce -- checks that the user has access
     if ( !isset($_POST['wp_nonce']) || !wp_verify_nonce( $_POST['wp_nonce'], basename(__FILE__) )) {
        return $post_id;
         if ($_POST['post_type'] == 'mytype') :
          $name1 = $_POST['term1'];
          $name2 = $_POST['term2'];
          $name3 = $_POST['custom_field_1'];
          $name4 = $_POST['custom_field_2'];
          $my_post_name = $name1."-".$name2."-".$name3."-".$name4."-".$this_post_id;
        return $my_post_name;

I just want to is it secure to save the data this way. Cause I read somewhere else (which is I forgot where), said that using $_POST['Custom_field']; is very easy to get hacked. Is it true?

1 Answer 1


Validate input values and sanitize outputting data. Take a read good article about Data Sanitization and Validation With WordPress, it will make you understanding these principles better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.