Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
5
votes
1answer
2k views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
7
votes
1answer
15k views

Custom page with variables in url. Nice url with add_rewrite_rule

Using WP3.1 I Have a custom page with a WP_Query and the query gets dynamic variables from the url. And i want safe variables and clean urls. Example: carpage/?carmodel=honda&location=...
16
votes
2answers
828 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
7
votes
1answer
381 views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '…' ) );...
6
votes
5answers
3k views

Sanitize User Entered CSS

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like ...
16
votes
2answers
6k views

Data sanitization: Best Practices with code examples

I am trying to understand data sanitization (not data validation) to help me write secure themes for WordPress. I have searched the Internet trying to find a comprehnsive guide for theme developers ...
8
votes
1answer
4k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
7
votes
2answers
3k views

What is the best way to sanitize data?

I've read several topics about this and different people have different views on the best practice. In terms of WordPress, how do I write data to the database the safest way? This is one insert I'm ...
13
votes
3answers
2k views

Should I sanitize an email address before passing it to the is_email() function?

I'm using is_email() to check if a user-provided email address is valid. For example: $email = $_POST['email']; if ( is_email( $email ) ) // Do something. To the best of my knowledge, nothing in ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
8
votes
1answer
6k views

How to safely sanitize a textarea which takes full HTML input

I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags ...
3
votes
1answer
2k views

Default Wordpress settings API data sanitization

It looks to me that when saving data to the database via the settings API Wordpress sanitizes data by default. By that I mean that if I look at the raw settings options in the database they have (at ...
4
votes
1answer
2k views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( $_POST[$...
3
votes
3answers
2k views

How do I sanitize a javascript text?

I have a textarea that will receive a js snippet(Google Analytics). Is there a way to sanitize that? Since I cannot use functions like wp_filter_nohtml_kse(), what should I use?
1
vote
1answer
180 views

How to get input_attrs in the sanitize function?

When I try to get input_attrs in the sanitize function I have always errors like: Trying to get property of non-object in ... How to do it ? Thanks in advance. Control class: class ...
1
vote
2answers
1k views

wp_sanitize_redirect strips out @ signs (even from parameters) — why?

In my Wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to ...