Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

3
votes
3answers
830 views

WP doesn't show Array Custom Fields?

I'm wondering why WordPress doesn't list PHP array() and any serialized data in Custom Fields in Admin Panel (for Pages, Posts etc.)? Only Custom Fields containing strings and numbers show up and can ...
1
vote
1answer
369 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
0
votes
1answer
383 views

function sanitize_title() does not appear to be working

Spent quite a while trying to figure this out. I've implemented a stop-gap function that mimics what I believe this function is supposed to be doing, but I would like to use the native libs/functions ...
2
votes
1answer
161 views

Sanitizing post content for use in an email

I'm sending the content of a custom post type in a plain text email (it's to send competition entries to a panel of judges), so I need to make sure that $post->post_content is correctly sanitized ...
0
votes
0answers
18 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
1answer
15 views

do I need to sanitize a shortcode's function input?

I'm using the following custom plugin to count the number of members in the MemberPress database: function display_member_count( $atts ) { global $wpdb; $sql = "SELECT COUNT(`meta_key`) as ...
0
votes
2answers
450 views

Best Practice for Validating and Sanitizing Data

I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly. To process the data, ...
1
vote
2answers
453 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
0
votes
2answers
26 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
1answer
513 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
1
vote
1answer
1k views

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
0
votes
0answers
11 views

Custom Customizer Image Sanitize fails to update image

I use this custom sanitizer to get the appropriate image size so that anyone using my themes can't mess up and put an 8k image in the website. The code works, but the problem I have is that once the ...
0
votes
2answers
24 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
1
vote
1answer
1k views

Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database

This adds the field to the add new tag form function tag_add_form_fields ( $taxonomy ){ ?> <div class="form-field term-colorpicker-wrap"> <label for="term-colorpicker">...
0
votes
1answer
34 views

HTML in category name

how can edit taxonomy.php in order to stop term sanitizing? I need HTML (font color) in category name. Thanks!
0
votes
1answer
21 views

WP_Customize_Manager: How to get control ID

I have this buggy sanitization function for "select" control: function sanitize_select( $input, $setting ) { $input = sanitize_key( $input ); $control = $setting->manager->get_control( $...
8
votes
4answers
2k views

Sanitize content from wp_editor

I built a custom post type where we can find a standard textarea/tinymce generated by wp_editor() and I'm facing an issue for the saving part. If I save the content with the following code : ...
11
votes
2answers
5k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., &...
0
votes
1answer
26 views

textarea field is getting escaped for some unknown reason

It doesn't happen outside of WordPress, so I'm posting here. I'm using a textarea field in a custom form, and before I have a chance to do anything with it, I find it's escaped: echo $_POST['...
15
votes
4answers
14k views

Is sanitize_title enough to generate post slugs?

I want to generate slug for some strings without going through WordPress slug generation flow. Therefore, I want to know which functions it calls to get a neat slug. I tried sanitize_title() but it ...
2
votes
0answers
35 views

Coding a plugin on WordPress; when should I sanitize? [duplicate]

I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
7
votes
1answer
307 views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '&hellip;' ) );...
1
vote
0answers
134 views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
1
vote
1answer
133 views

How to get input_attrs in the sanitize function?

When I try to get input_attrs in the sanitize function I have always errors like: Trying to get property of non-object in ... How to do it ? Thanks in advance. Control class: class ...
1
vote
1answer
56 views

Modify automatically generation of slug when term is created

I need modify the sanitize of slug when a term is created. For example I'm creating a term with name 0,5 and the slug automatically generated is 05. I need to add a dash in the position of the comma, ...
0
votes
3answers
3k views

What's The Proper Way To SAnitize Checkbox Value Sent To The Database

I have tried using sanitize_text_field() and esc_attr() to filter checkbox data when saving their values to the database, but it is causing the data not being saved. What is causing it and what's the ...
1
vote
2answers
1k views

wp_sanitize_redirect strips out @ signs (even from parameters) — why?

In my Wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to ...
1
vote
0answers
22 views

Is wp_kses the right approach in sanitizing this string?

I have a function that trims my post title and I escape the final output using wp_kses. Is this the right approach? function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' ) { $title = ...
0
votes
1answer
47 views

What's a safe / good way to output HTML safely within WordPress templates?

Assume I have a function that returns HTML output after it's done processing it: function parse_html_for_images() { return '<img src="' . thumbnail_url() . '">'; } I need to output this ...
1
vote
4answers
51k views

How to display data from custom table in wordpress database?

I want to retrieve data from custom table, that I've made inside the wordpress database and display it in a wordpress page , like posts Thanks in advance
3
votes
2answers
210 views

Sanitizing `wp_editor();` Values for Database, Edit, and Display

I'm using custom instances of wp_editor(); to allow rich text editing of Post Meta associated with a Post Object. I'd like to perform much of the same sanitization that occurs with post_content for ...
1
vote
1answer
288 views

Why does wp_redirect strip out %0A (url encoded new line character) and how do I make it stop?

Does this have something to do with sanitization? I need to pass a string as a URL parameter, and that string has \n characters in it. When the URL gets to the client, all other encoding is there (...
0
votes
1answer
37 views

Preserve old values on error in setting API

I am trying to preserve old value of form when it fails the validation defined in sanitize callback of register_setting. But it does not do so, instead it save the default values register_setting('...
1
vote
1answer
976 views

WP_Editor - Saving Value into Plugin Option - Stripping HTML

I have a wp_editor(); on my plugin settings page. I also have enabled the "Font Size" drop down in TinyMCE. After highlighting text in the wp_editor(); and selecting a font size from the editor's ...
1
vote
1answer
123 views

How to sanitize my cookie name

guys! I'm setting a cookie after my Gravity Form is submitted. The name is based on the current page, so each page that has this form will have its own cookie. Some pages with urls ending such as /...
2
votes
1answer
65 views

where to apply “apply filters” and other Sanitization Functions

I got to learn something new today here on this post. I have code written for a Post widget → <?php class chimp_post_widget extends WP_Widget { function __construct() { ...
1
vote
1answer
110 views

WordPress Settings API - Sanitize Integer

I am sanitizing a text field input via a custom WordPress Setting API page like this... public function current_issue_sanitize($input) { $sanitary_values = array(); if ( isset( $input['...
5
votes
1answer
129 views

Shortcode putting html such as <img>

$atts = shortcode_atts( array( 'path' => 'https://s.w.org/about/images/logos/wordpress-logo-simplified-rgb.png' ), $atts); The above is a part of the shortcode. In Wordpress text ...
2
votes
2answers
2k views

how to sanitize checkbox input?

I've added meta box: checkbox on admin edit screen <input type="checkbox" name="changeposition" /> So how could we sanitize the input came from the checkbox as we do for input type text by ...
6
votes
2answers
2k views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
7
votes
1answer
15k views

Custom page with variables in url. Nice url with add_rewrite_rule

Using WP3.1 I Have a custom page with a WP_Query and the query gets dynamic variables from the url. And i want safe variables and clean urls. Example: carpage/?carmodel=honda&location=...
0
votes
1answer
95 views

How can I apply custom sanitization to new usernames?

I have a WooCommerce module creating Wordpress usernames on my behalf. I want to make sure those usernames are sanitized according to my rules, which are stricter than the Wordpress requirements. How ...
0
votes
1answer
101 views

How WordPress sanitizes post content on save? Or it doesn't?

Does WordPress apply any kind of data sanitization for its post content when saving it from admin area? (like stripping <script> tags) Or all it does is checks for some user capability (like ...
0
votes
1answer
255 views

How do I sanitize the str_replace function in javascript variables

I have the following code in the javascript which outputs the date(s). With backslash for that, I'm replacing those strings with the str_replace to remove backslash, but I can't sanitize that using ...
0
votes
0answers
43 views

Form Sanitization and Validation

Already asked this on Code Review but no answer there so that's why i'm trying here. I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
-1
votes
1answer
411 views

How to use esc_attr__() function properly to translate a variable that contains string?

I am trying to develop a theme and trying to escape a string using esc_attr__() fuction. Here is how I implemented it. $title = stoic_get_the_site_title(); echo esc_attr__($title, 'stoic'); But ...
16
votes
2answers
6k views

Data sanitization: Best Practices with code examples

I am trying to understand data sanitization (not data validation) to help me write secure themes for WordPress. I have searched the Internet trying to find a comprehnsive guide for theme developers ...
0
votes
2answers
73 views

Data not displaying in text field

I have been working on trying to get data to store and display on a CPT field. The code I have is here: function fhaac_subject_box_callback( $post ){ wp_nonce_field( basename(__FILE__ ), '...
1
vote
4answers
6k views

Sanitize textarea instead of input

I want to add a new field to the user registration. I'm using this tutorial by Paul Underwood. The tutorial works but I want to switch the input text to a textarea which I do know how to do. The ...
1
vote
1answer
42 views

Can i use the same sanitize function on multiple theme mod textboxes?

I have a theme mod with multiple options and currently adding sanitizing options to those choices. This is my code I'm using: $wp_customize->add_section( 'twsa_feed' , array( 'title' => ...