All Questions
Tagged with escaping sanitization
22 questions
0
votes
1
answer
247
views
how to sanitizing $_POST with the correct way?
I am trying to sanitize and validate and escape this code?
$positions = $_POST['positions'];
foreach ($positions as $key => $position) {
$id = sanitize_text_field($position[0]);
...
1
vote
1
answer
2k
views
esc_url, esc_url_raw or sanitize_url?
I know there's already this post here but its answers still leave me in the dark about these three methods.
I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
- 497
2
votes
1
answer
452
views
Sanitizing comments or escaping comment_text()
I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
- 53
1
vote
1
answer
1k
views
Sanitizing, Validating and Escaping in WordPress (Plugin)
I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some ...
- 159
2
votes
1
answer
3k
views
Which escape function to use when escaping an email or plain text?
I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
- 357
0
votes
1
answer
256
views
How to escape html generate by a loop
I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer.
WARNING All output should be run through an escaping function (see the Security sections in the ...
0
votes
0
answers
120
views
How to use wp_filter_oembed_result?
I have a video iframe it's can be youtube , vimeo etc
$iframe = get_field($field, $id);
if(empty($iframe)){
return;
}
preg_match('/...
user145078
10
votes
1
answer
2k
views
Sanitize and data validation with apply_filters() function
Should we sanitize and validate the apply_filters() like the examples below?
absint( apply_filters( 'slug_excerpt_length', 35 ) );
wp_kses_post( apply_filters( 'slug_excerpt_more', '…' ) );...
- 103
2
votes
1
answer
2k
views
Must I serialize/sanitize/escape array data before using set_transient?
Everything is in the question.
For a notices system to show warnings/errors in the admin, I´m using transient.
When I published my first plugin, I received an email to ask me to sanitize/validate/...
- 900
2
votes
1
answer
1k
views
Escape hexadecimals/rgba values
I know that sanitize_hex_color exists for sanitizing hexadecimal values going into the database (and only exists in the Customizer), but what's the best function to escape those same values. Should I ...
- 133
10
votes
2
answers
897
views
Escaping and sanitizing SVGs in metabox textarea
I want to include inline SVGs in a metabox textarea.
That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it?
Halp?
Thanks!
- 101
1
vote
1
answer
70
views
What is the safe way to print tracking code / pixel code before </head> tag or </body> tag
What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options.
In header.php I printed the following code before the </head> tag
if (...
- 111
0
votes
0
answers
413
views
Escaping and sanitization
I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
- 1,930
5
votes
1
answer
4k
views
Escaping WP_Query tax_query when term has special character(s)
Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
- 952
1
vote
1
answer
1k
views
WP_Editor - Saving Value into Plugin Option - Stripping HTML
I have a wp_editor(); on my plugin settings page.
I also have enabled the "Font Size" drop down in TinyMCE.
After highlighting text in the wp_editor(); and selecting a font size from the editor's ...
- 6,802
10
votes
3
answers
5k
views
How to escape custom css?
I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
- 1,067
0
votes
4
answers
356
views
Do we need to escape data that we receive from theme options?
I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
- 1,067
1
vote
1
answer
5k
views
How to sanitize user input?
What is the correct way sanitizing form data before submitting to the database? I have the following text input:
<form method="post" action="options.php">
<?php wp_nonce_field('update-...
- 432
12
votes
2
answers
9k
views
Should HTML output be passed through esc_html() AND wp_kses()?
I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., &...
- 4,857
2
votes
2
answers
4k
views
why is esc_html() returning nothing given a string containing a high-bit character?
In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
- 75
1
vote
1
answer
619
views
How Could I sanitize the receive data from this code
<form id="tellastory" method="post" action="">
<label for="fullname">Full Name </label>
<input id="fullname" name="fullname" type="text" maxlength="255" value=""/>
...
- 389
8
votes
1
answer
4k
views
What's the difference between esc_* functions?
I've read Professional WordPress and it says:
esc_html function is used for
scrubbing data that contains HTML.
This function encodes special
characters into their HTML entities
esc_attr ...
- 1,911