Questions tagged [sanitization]
Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.
216
questions
0
votes
1
answer
30
views
Sanitize a custom date meta field
I have to sanitize the following
<input type="date" id="periodo_1da" name="periodo_1da" class="list_prezzi" ><?php echo esc_attr( get_the_author_meta( '...
2
votes
1
answer
87
views
What is the proper way to sanitize $_POST and $_GET vars?
I am trying to understand the proper way to sanitize data in different situations.
If I understand correctly, WordPress automatically applies a wp_slash() on the global $_POST variable: should this ...
- 33
0
votes
1
answer
151
views
Does it make sense to sanitize the output of an SVG file?
I'm developing a plugin. In its settings page I want to use SVG icons. This is how I render SVG icons:
<div class="svg-wrap">
<?php echo file_get_contents(ABSPATH . 'wp-content/...
- 1
0
votes
0
answers
28
views
1st dynamic table row content is not saved on initial update
This is what is used in my plugin. A meta field that allows the user in a page editor to add table rows and three columns. As many rows as needed. The issue I am facing is I add a row, then populate ...
1
vote
0
answers
28
views
Extend file format support for post thumbnails
I am trying to enable video thumbnails for posts in my theme. I created a custom post thumbnail media uploader in an editor plugin as follows (This is necessary, because the default uploader can't ...
- 21
0
votes
1
answer
47
views
how to sanitizing $_POST with the correct way?
I am trying to sanitize and validate and escape this code?
$positions = $_POST['positions'];
foreach ($positions as $key => $position) {
$id = sanitize_text_field($position[0]);
...
0
votes
1
answer
536
views
esc_url, esc_url_raw or sanitize_url?
I know there's already this post here but its answers still leave me in the dark about these three methods.
I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
- 487
0
votes
1
answer
56
views
Properly sanitize an input field "Name <[email protected]>"
In my plugin I want administrators to be able to set the from name and email address in a single form field.
I anticipate the field content to be Name <[email protected]> However both ...
- 277
0
votes
0
answers
43
views
Escaping data from database (users table) is necessary?
I've submitted a plugin for review and it was not accepted as it needs some fixes with data sanitization and escaping.
One of the flagged examples was this line:
echo "<option value=\"$...
- 37
0
votes
0
answers
41
views
How to return responsive images from a sanitize_callback?
I'm trying to sanitize the images of the customizer from my theme.
I found an example on this topic and it works, but makes my template stop showing the image.
With a var_dump(), I found out that the ...
- 1
0
votes
1
answer
115
views
How can I properly sanitize the update_option in WordPress?
I am using this part of the code in my WordPress plugin to update the option.
update_option('button_loc_shop_page', $_POST['button_loc_shop_page']);
I want to sanitize this. How can I properly ...
1
vote
1
answer
182
views
oneOf two possible objects in WP REST API?
I'm trying to define an endpoint that accepts two possible objects upon input, and currently tried to do so via:
'args' => [
'type' => 'object',...
- 487
0
votes
1
answer
158
views
HTML Img with data:image src gets sanitized in admin?
In the WordPress admin panel (dashboard), I want to add an image inside an ACF field description. Since it's a simple SVG icon, I want to load it using <img src="data:image/svg+xml..." /&...
- 175
0
votes
1
answer
666
views
Sanitizing URL in a WordPress plugin
I am trying to get the current page url which require the use of $_SERVER["REQUEST_URI"].
The point is how do I need to sanitize the returned URL?
I tried to use sanitize_url( string $url, ...
- 1
0
votes
1
answer
43
views
How to allow certain PHP functions when using sanitize_callback in the word press customizer
Hi I am making my own theme in WordPress and setting up some customizer options and I have one for the text in my footer but I would like to still use <? echo date('Y');?> in the footer to ...
- 1
2
votes
2
answers
3k
views
wpdb get_results() and prepare when to use prepare?
so if i have a function that gets terms from the database ( not the user ) do I need to use prepare first ( before get_results() ), or some sort of data sanitizing?
1
vote
1
answer
122
views
Cannot get 'sanitize_callback' to work for rest parameters
I'm trying to sanitize my rest parameters using sanitize_callback:
register_rest_route( SoundSystem::$rest_namespace, '/playlist/new', array(
'methods' => WP_REST_Server::CREATABLE,
'callback' =...
- 482
1
vote
1
answer
439
views
Settings API - sanitize_callback is not called and it leads to an incorrect behavior
I am in the process of creating some options / the options page for my plugin.
In the context of this I have only added two checkboxes so far to store boolean values. The creation, display on the page ...
- 21
1
vote
0
answers
685
views
Sanitize array callback for the WordPress Settings API
I am used to register plugin settings like this:
$string_sanitization = array(
'sanitize_callback' => 'sanitize_text_field',
);
// Section Setting: Just some example string
register_setting(
...
- 948
3
votes
0
answers
2k
views
Correct processing of `$_POST`, following WordPress Coding Standards
Background
I'm building a project that according to the specifications need to follow the WordPress Coding Standards. I am using phpcs to scan my code.
If I try to pass $_POST-data into a function ...
- 384
0
votes
2
answers
421
views
Do I need to sanitize $_POST['keyword'] before send to 's' parameter?
Anyone know how to sanitize the $_POST for wordpress?
$args = array(
's' => esc_attr( $_POST['keyword'] ),
);
8
votes
3
answers
2k
views
Does WordPress sanitize arguments to WP_Query?
This is a very straight-forward question, but it's important and I can't find anything definitive in the docs.
This question asks a similar question for the 's' parameter, specifically. I want to know ...
- 1,317
2
votes
1
answer
349
views
Sanitizing comments or escaping comment_text()
I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
- 53
0
votes
1
answer
46
views
Input sanitation
I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
- 135
1
vote
1
answer
797
views
Sanitizing, Validating and Escaping in WordPress (Plugin)
I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some ...
- 159
4
votes
1
answer
1k
views
Should I sanitize custom post meta if it is going to be escaped later?
Firstly, sorry if this has been properly answered before. After reading a lot of questions and guides, I'm still not totally convinced on the best way of doing things.
I understand the basics of XSS- ...
- 43
0
votes
0
answers
254
views
Can non-latin characters appear in slugs?
For a non-latin category name such as "我的种类", the slug generated is "%e6%88%91%e7%9a%84%e7%a7%8d%e7%b1%bb". What function does Wordpress use to generate this slug? Can I directly ...
- 103
3
votes
1
answer
1k
views
What is the proper way to validate and sanitize JSON response from REST API?
I have read the WordPress page about this but didn't find a solution.
Here are my details:
register rest route:
register_rest_route(
'/jwt-auth/v1',
'/user',
array(
'methods' ...
- 141
0
votes
1
answer
55
views
Wordpress messes up with data attributes in shortcode output
I have build a shortcode to insert a call to action text and button/link. The button/link should open a modal window with a contact form. So I added data attributes to the button/link for Bootstrap ...
- 21
1
vote
1
answer
35
views
MITM risk of not sanitizing?
The plugin review team has rejected my plugin because they say I'm not sanitizing data. Here is the snippet:
function add_cookie_to_order( $order_id ) {
if ( isset( $_COOKIE['tm_clickid'] ) &&...
- 131
0
votes
1
answer
418
views
How to escape $_GET and check if isset?
I submitted a plugin to wordpress and I got a feedback that I have to escape this one
$active_tab = isset( $_GET[ 'tab' ] ) ? $_GET[ 'tab' ] : 'front_page_options';
If I do like
$get_the_param = ...
user145078
1
vote
1
answer
347
views
Copy content stored in meta to post content
I'm working on a site that had an existing theme that used meta fields to store blocks (bad practice IMO but pre-block editor).
The problem is there are over 300 posts and all the different "...
- 13
0
votes
2
answers
981
views
Display the line breaks in user bio without using html
User fills their user bio using Formidable forms.
It saves correctly and displays with line breaks in Worpdress admin on the user overview page.
It displays without line breaks on the site.
The only ...
0
votes
0
answers
737
views
how to sanitize customizer checkbox control
When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
- 151
0
votes
1
answer
89
views
Trouble matching strings (titles) using wp_query
I'm repairing an old site on which we match the titles of two types of posts to link them together. There is a wp_query which uses 'title' => get_the_title() to do this, but it only works some of ...
0
votes
1
answer
945
views
Sanitize WordPress Array Input?
I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing.
Is there a better ...
- 101
2
votes
1
answer
2k
views
Which escape function to use when escaping an email or plain text?
I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
- 357
0
votes
1
answer
1k
views
Sanitize user input fields before wp_insert_post
I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags.
However, I'm new to development and would like to be confirmed ...
- 25
0
votes
1
answer
391
views
Change user nicename without sanitize
How to remove sanitize from edit_user_profile action?
I have a possibility to change user_nicename with the following code:
function ex_insert_nicename_input( $user ) {
$content = ob_get_clean();...
1
vote
1
answer
598
views
remove_accents does not seem to work (when used inside sanitize_file_name filter)
I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php):
add_filter('sanitize_file_name', function($filename) {
...
- 416
0
votes
1
answer
752
views
How to save Checkbox-Options in Plugin Options Page
First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far).
About my plugin:
It creates to post types and some meta boxes ...
3
votes
2
answers
1k
views
WP Coding standards - escaping the inescapable?
How do you escape these two examples?
wc_price() wraps the already escaped $product_price in p and span tags with currency symbol.
$product_price = $product->get_price();
<p><?php echo ...
- 33
2
votes
2
answers
4k
views
What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?
I need to sanitize some custom settings added with the Customize API, namely some simple text fields.
Other data types have some dedicated functions, i.e. email addresses should use sanitize_email(), ...
- 141
0
votes
1
answer
196
views
How to escape html generate by a loop
I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer.
WARNING All output should be run through an escaping function (see the Security sections in the ...
4
votes
1
answer
370
views
Is there an equivalent of the PHP function sanitize_key in Gutenberg?
In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
- 647
0
votes
0
answers
102
views
How to use wp_filter_oembed_result?
I have a video iframe it's can be youtube , vimeo etc
$iframe = get_field($field, $id);
if(empty($iframe)){
return;
}
preg_match('/...
user145078
1
vote
1
answer
1k
views
Is it necessary to sanitize wp_set_password user input?
I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?)
If I understand it correctly, WP ...
- 105
0
votes
1
answer
87
views
confused about sanitize_email after is_email [duplicate]
Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?
- 141
2
votes
2
answers
2k
views
array_map() for sanitizing $_POST
I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
- 86
0
votes
1
answer
519
views
Sanitize $_GET variable when comparing
I know when I want to save data in database, I must sanitize data but what about following case which is a simple comparison. Should I sanitize?
if ( ! isset( $_GET['page'] ) ) {
return;
}
...
- 163