Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

How to escape $_GET and check if isset?

I submitted a plugin to wordpress and I got a feedback that I have to escape this one $active_tab = isset( $_GET[ 'tab' ] ) ? $_GET[ 'tab' ] : 'front_page_options'; If I do like $get_the_param = ...
1
vote
1answer
24 views

Copy content stored in meta to post content

I'm working on a site that had an existing theme that used meta fields to store blocks (bad practice IMO but pre-block editor). The problem is there are over 300 posts and all the different "...
0
votes
0answers
14 views

Display the line breaks in user bio without using html

User fills their user bio using Formidable forms. It saves correctly and displays with line breaks in Worpdress admin on the user overview page. It displays without line breaks on the site. The only ...
0
votes
0answers
40 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
0
votes
1answer
31 views

Trouble matching strings (titles) using wp_query

I'm repairing an old site on which we match the titles of two types of posts to link them together. There is a wp_query which uses 'title' => get_the_title() to do this, but it only works some of ...
0
votes
1answer
23 views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
0
votes
0answers
17 views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
0
votes
1answer
55 views

Sanitize user input fields before wp_insert_post

I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags. However, I'm new to development and would like to be confirmed ...
0
votes
1answer
61 views

Change user nicename without sanitize

How to remove sanitize from edit_user_profile action? I have a possibility to change user_nicename with the following code: function ex_insert_nicename_input( $user ) { $content = ob_get_clean();...
0
votes
0answers
76 views

how to sanitize, store and restore a regex pattern string?

I'm writing a plugin and I need to store "complex" strings, among others regex patterns, eg. (?:‘|“)(.*)(?:’|”) There might also have html tags in there. ...
1
vote
1answer
87 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
0
votes
1answer
33 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
1
vote
2answers
87 views

WP Coding standards - escaping the inescapable?

How do you escape these two examples? wc_price() wraps the already escaped $product_price in p and span tags with currency symbol. $product_price = $product->get_price(); <p><?php echo ...
0
votes
0answers
11 views

Sanitize Wordpress custom Post Type metabox not working or saving when using the funcitn wp_kses

if ( isset( $_POST['cloudlyup_maulti_location_gmap_fields'] )){ $old = get_post_meta( $post_id, 'cloudlyup_maulti_location_gmap_fields', true ); $new = sanitize_meta( '...
1
vote
2answers
470 views

What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?

I need to sanitize some custom settings added with the Customize API, namely some simple text fields. Other data types have some dedicated functions, i.e. email addresses should use sanitize_email(), ...
0
votes
1answer
57 views

How to escape html generate by a loop

I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer. WARNING All output should be run through an escaping function (see the Security sections in the ...
1
vote
0answers
80 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
0
votes
0answers
31 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
0
votes
1answer
274 views

Is it necessary to sanitize wp_set_password user input?

I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?) If I understand it correctly, WP ...
0
votes
1answer
40 views

confused about sanitize_email after is_email [duplicate]

Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?
2
votes
2answers
415 views

array_map() for sanitizing $_POST

I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
0
votes
1answer
151 views

Sanitize $_GET variable when comparing

I know when I want to save data in database, I must sanitize data but what about following case which is a simple comparison. Should I sanitize? if ( ! isset( $_GET['page'] ) ) { return; } ...
0
votes
0answers
59 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. This all works ...
0
votes
1answer
26 views

Does meta-data need to be sanitized?

Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use ...
0
votes
0answers
25 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
1answer
98 views

do I need to sanitize a shortcode's function input?

I'm using the following custom plugin to count the number of members in the MemberPress database: function display_member_count( $atts ) { global $wpdb; $sql = "SELECT COUNT(`meta_key`) as ...
0
votes
2answers
61 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
2answers
125 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
0
votes
1answer
188 views

HTML in category name

how can edit taxonomy.php in order to stop term sanitizing? I need HTML (font color) in category name. Thanks!
0
votes
1answer
34 views

WP_Customize_Manager: How to get control ID

I have this buggy sanitization function for "select" control: function sanitize_select( $input, $setting ) { $input = sanitize_key( $input ); $control = $setting->manager->get_control( $...
0
votes
1answer
46 views

textarea field is getting escaped for some unknown reason

It doesn't happen outside of WordPress, so I'm posting here. I'm using a textarea field in a custom form, and before I have a chance to do anything with it, I find it's escaped: echo $_POST['...
2
votes
0answers
69 views

Coding a plugin on WordPress; when should I sanitize? [duplicate]

I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
8
votes
1answer
664 views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '&hellip;' ) );...
2
votes
1answer
543 views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
1
vote
1answer
280 views

How to get input_attrs in the sanitize function?

When I try to get input_attrs in the sanitize function I have always errors like: Trying to get property of non-object in ... How to do it ? Thanks in advance. Control class: class ...
1
vote
1answer
171 views

Modify automatically generation of slug when term is created

I need modify the sanitize of slug when a term is created. For example I'm creating a term with name 0,5 and the slug automatically generated is 05. I need to add a dash in the position of the comma, ...
1
vote
0answers
37 views

Is wp_kses the right approach in sanitizing this string?

I have a function that trims my post title and I escape the final output using wp_kses. Is this the right approach? function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' ) { $title = ...
0
votes
1answer
238 views

What's a safe / good way to output HTML safely within WordPress templates?

Assume I have a function that returns HTML output after it's done processing it: function parse_html_for_images() { return '<img src="' . thumbnail_url() . '">'; } I need to output this ...
2
votes
2answers
521 views

Sanitizing `wp_editor();` Values for Database, Edit, and Display

I'm using custom instances of wp_editor(); to allow rich text editing of Post Meta associated with a Post Object. I'd like to perform much of the same sanitization that occurs with post_content for ...
1
vote
1answer
981 views

Why does wp_redirect strip out %0A (url encoded new line character) and how do I make it stop?

Does this have something to do with sanitization? I need to pass a string as a URL parameter, and that string has \n characters in it. When the URL gets to the client, all other encoding is there (...
1
vote
1answer
714 views

How to sanitize my cookie name

guys! I'm setting a cookie after my Gravity Form is submitted. The name is based on the current page, so each page that has this form will have its own cookie. Some pages with urls ending such as /...
1
vote
1answer
381 views

WordPress Settings API - Sanitize Integer

I am sanitizing a text field input via a custom WordPress Setting API page like this... public function current_issue_sanitize($input) { $sanitary_values = array(); if ( isset( $input['...
4
votes
1answer
280 views

Shortcode putting html such as <img>

$atts = shortcode_atts( array( 'path' => 'https://s.w.org/about/images/logos/wordpress-logo-simplified-rgb.png' ), $atts); The above is a part of the shortcode. In Wordpress text ...
3
votes
2answers
6k views

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
0
votes
1answer
365 views

How can I apply custom sanitization to new usernames?

I have a WooCommerce module creating Wordpress usernames on my behalf. I want to make sure those usernames are sanitized according to my rules, which are stricter than the Wordpress requirements. How ...
0
votes
1answer
175 views

How WordPress sanitizes post content on save? Or it doesn't?

Does WordPress apply any kind of data sanitization for its post content when saving it from admin area? (like stripping <script> tags) Or all it does is checks for some user capability (like ...
0
votes
1answer
386 views

How do I sanitize the str_replace function in javascript variables

I have the following code in the javascript which outputs the date(s). With backslash for that, I'm replacing those strings with the str_replace to remove backslash, but I can't sanitize that using ...
0
votes
0answers
66 views

Form Sanitization and Validation

Already asked this on Code Review but no answer there so that's why i'm trying here. I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
-1
votes
1answer
825 views

How to use esc_attr__() function properly to translate a variable that contains string?

I am trying to develop a theme and trying to escape a string using esc_attr__() fuction. Here is how I implemented it. $title = stoic_get_the_site_title(); echo esc_attr__($title, 'stoic'); But ...
0
votes
1answer
672 views

Function sanitize_title() does not appear to be working

I've implemented a stop-gap function that mimics what I believe this function is supposed to be doing, but I would like to use the native libs/functions where possible. <?php phpinfo(); ...