Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
0 votes
1 answer
38 views

Sanitizing URL in a WordPress plugin

I am trying to get the current page url which require the use of $_SERVER["REQUEST_URI"]. The point is how do I need to sanitize the returned URL? I tried to use sanitize_url( string $url, ...
user avatar
  • 1
0 votes
1 answer
24 views

How to allow certain PHP functions when using sanitize_callback in the word press customizer

Hi I am making my own theme in WordPress and setting up some customizer options and I have one for the text in my footer but I would like to still use <? echo date('Y');?> in the footer to ...
user avatar
1 vote
2 answers
75 views

wpdb get_results() and prepare when to use prepare?

so if i have a function that gets terms from the database ( not the user ) do I need to use prepare first ( before get_results() ), or some sort of data sanitizing?
user avatar
0 votes
0 answers
12 views

How to allow arbitrary inline CSS in posts?

Sometimes, I want to apply inline style—i.e. custom CSS for a single element, oftentimes unique across the site. But, with a very few exceptions, WordPress seems to strip these out. When I, the site ...
user avatar
1 vote
1 answer
15 views

Cannot get 'sanitize_callback' to work for rest parameters

I'm trying to sanitize my rest parameters using sanitize_callback: register_rest_route( SoundSystem::$rest_namespace, '/playlist/new', array( 'methods' => WP_REST_Server::CREATABLE, 'callback' =...
user avatar
  • 452
1 vote
1 answer
139 views

Settings API - sanitize_callback is not called and it leads to an incorrect behavior

I am in the process of creating some options / the options page for my plugin. In the context of this I have only added two checkboxes so far to store boolean values. The creation, display on the page ...
user avatar
1 vote
0 answers
208 views

Sanitize array callback for the WordPress Settings API

I am used to register plugin settings like this: $string_sanitization = array( 'sanitize_callback' => 'sanitize_text_field', ); // Section Setting: Just some example string register_setting( ...
user avatar
3 votes
0 answers
790 views

Correct processing of `$_POST`, following WordPress Coding Standards

Background I'm building a project that according to the specifications need to follow the WordPress Coding Standards. I am using phpcs to scan my code. If I try to pass $_POST-data into a function ...
user avatar
0 votes
2 answers
87 views

Do I need to sanitize $_POST['keyword'] before send to 's' parameter?

Anyone know how to sanitize the $_POST for wordpress? $args = array( 's' => esc_attr( $_POST['keyword'] ), );
user avatar
4 votes
3 answers
791 views

Does WordPress sanitize arguments to WP_Query?

This is a very straight-forward question, but it's important and I can't find anything definitive in the docs. This question asks a similar question for the 's' parameter, specifically. I want to know ...
user avatar
  • 1,237
2 votes
1 answer
156 views

Sanitizing comments or escaping comment_text()

I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
user avatar
0 votes
1 answer
32 views

Input sanitation

I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
user avatar
  • 135
1 vote
1 answer
323 views

Sanitizing, Validating and Escaping in WordPress (Plugin)

I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some ...
user avatar
  • 147
3 votes
1 answer
506 views

Should I sanitize custom post meta if it is going to be escaped later?

Firstly, sorry if this has been properly answered before. After reading a lot of questions and guides, I'm still not totally convinced on the best way of doing things. I understand the basics of XSS- ...
user avatar
  • 33
0 votes
0 answers
121 views

Can non-latin characters appear in slugs?

For a non-latin category name such as "我的种类", the slug generated is "%e6%88%91%e7%9a%84%e7%a7%8d%e7%b1%bb". What function does Wordpress use to generate this slug? Can I directly ...
user avatar
  • 103
1 vote
1 answer
732 views

What is the proper way to validate and sanitize JSON response from REST API?

I have read the WordPress page about this but didn't find a solution. Here are my details: register rest route: register_rest_route( '/jwt-auth/v1', '/user', array( 'methods' ...
user avatar
  • 121
0 votes
1 answer
45 views

Wordpress messes up with data attributes in shortcode output

I have build a shortcode to insert a call to action text and button/link. The button/link should open a modal window with a contact form. So I added data attributes to the button/link for Bootstrap ...
user avatar
  • 21
1 vote
1 answer
33 views

MITM risk of not sanitizing?

The plugin review team has rejected my plugin because they say I'm not sanitizing data. Here is the snippet: function add_cookie_to_order( $order_id ) { if ( isset( $_COOKIE['tm_clickid'] ) &&...
user avatar
  • 131
0 votes
1 answer
212 views

How to escape $_GET and check if isset?

I submitted a plugin to wordpress and I got a feedback that I have to escape this one $active_tab = isset( $_GET[ 'tab' ] ) ? $_GET[ 'tab' ] : 'front_page_options'; If I do like $get_the_param = ...
user avatar
1 vote
1 answer
211 views

Copy content stored in meta to post content

I'm working on a site that had an existing theme that used meta fields to store blocks (bad practice IMO but pre-block editor). The problem is there are over 300 posts and all the different "...
user avatar
0 votes
2 answers
577 views

Display the line breaks in user bio without using html

User fills their user bio using Formidable forms. It saves correctly and displays with line breaks in Worpdress admin on the user overview page. It displays without line breaks on the site. The only ...
user avatar
0 votes
0 answers
478 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
user avatar
0 votes
1 answer
42 views

Trouble matching strings (titles) using wp_query

I'm repairing an old site on which we match the titles of two types of posts to link them together. There is a wp_query which uses 'title' => get_the_title() to do this, but it only works some of ...
user avatar
0 votes
1 answer
519 views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
user avatar
  • 101
1 vote
1 answer
546 views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
user avatar
  • 337
0 votes
1 answer
547 views

Sanitize user input fields before wp_insert_post

I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags. However, I'm new to development and would like to be confirmed ...
user avatar
  • 25
0 votes
1 answer
253 views

Change user nicename without sanitize

How to remove sanitize from edit_user_profile action? I have a possibility to change user_nicename with the following code: function ex_insert_nicename_input( $user ) { $content = ob_get_clean();...
user avatar
1 vote
1 answer
447 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
user avatar
0 votes
1 answer
391 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
user avatar
3 votes
2 answers
957 views

WP Coding standards - escaping the inescapable?

How do you escape these two examples? wc_price() wraps the already escaped $product_price in p and span tags with currency symbol. $product_price = $product->get_price(); <p><?php echo ...
user avatar
2 votes
2 answers
2k views

What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?

I need to sanitize some custom settings added with the Customize API, namely some simple text fields. Other data types have some dedicated functions, i.e. email addresses should use sanitize_email(), ...
user avatar
  • 141
0 votes
1 answer
102 views

How to escape html generate by a loop

I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer. WARNING All output should be run through an escaping function (see the Security sections in the ...
user avatar
3 votes
1 answer
202 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
user avatar
  • 615
0 votes
0 answers
59 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
user avatar
1 vote
1 answer
915 views

Is it necessary to sanitize wp_set_password user input?

I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?) If I understand it correctly, WP ...
user avatar
0 votes
1 answer
60 views

confused about sanitize_email after is_email [duplicate]

Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?
user avatar
  • 131
2 votes
2 answers
1k views

array_map() for sanitizing $_POST

I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
user avatar
0 votes
1 answer
395 views

Sanitize $_GET variable when comparing

I know when I want to save data in database, I must sanitize data but what about following case which is a simple comparison. Should I sanitize? if ( ! isset( $_GET['page'] ) ) { return; } ...
user avatar
0 votes
0 answers
298 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. This all works ...
user avatar
  • 3,611
0 votes
1 answer
69 views

Does meta-data need to be sanitized?

Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use ...
user avatar
  • 101
0 votes
0 answers
35 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
user avatar
0 votes
1 answer
200 views

do I need to sanitize a shortcode's function input?

I'm using the following custom plugin to count the number of members in the MemberPress database: function display_member_count( $atts ) { global $wpdb; $sql = "SELECT COUNT(`meta_key`) as ...
user avatar
  • 1,672
0 votes
2 answers
75 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
user avatar
0 votes
2 answers
333 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
user avatar
0 votes
1 answer
452 views

HTML in category name

how can edit taxonomy.php in order to stop term sanitizing? I need HTML (font color) in category name. Thanks!
user avatar
0 votes
1 answer
72 views

WP_Customize_Manager: How to get control ID

I have this buggy sanitization function for "select" control: function sanitize_select( $input, $setting ) { $input = sanitize_key( $input ); $control = $setting->manager->get_control( $...
user avatar
  • 25
0 votes
1 answer
268 views

textarea field is getting escaped for some unknown reason

It doesn't happen outside of WordPress, so I'm posting here. I'm using a textarea field in a custom form, and before I have a chance to do anything with it, I find it's escaped: echo $_POST['...
user avatar
  • 319
2 votes
0 answers
140 views

Coding a plugin on WordPress; when should I sanitize? [duplicate]

I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
user avatar
  • 167
9 votes
1 answer
1k views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '&hellip;' ) );...
user avatar
  • 93
2 votes
1 answer
1k views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
user avatar
  • 770

1
2 3 4 5