Questions tagged [sanitization]
Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.
217
questions
0
votes
1
answer
528
views
Sanitize $_GET variable when comparing
I know when I want to save data in database, I must sanitize data but what about following case which is a simple comparison. Should I sanitize?
if ( ! isset( $_GET['page'] ) ) {
return;
}
...
0
votes
0
answers
398
views
Customizer textarea with script tag won't work in live preview
I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea.
This all works ...
0
votes
1
answer
103
views
Does meta-data need to be sanitized?
Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use ...
0
votes
0
answers
52
views
Data Validation & Sanitization for Big HTML Blocks
I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable?
Thank ...
0
votes
1
answer
284
views
do I need to sanitize a shortcode's function input?
I'm using the following custom plugin to count the number of members in the MemberPress database:
function display_member_count( $atts ) {
global $wpdb;
$sql = "SELECT COUNT(`meta_key`) as ...
0
votes
2
answers
93
views
Where is the HTML-handler part in the wpdb class?
I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
2
answers
476
views
I need to get the control choices to sanitize_callback
Code
Currently, I'm working project to automatically generate all my theme customizer options with simple array.
'nav_font_style' => array(
'default_options' => array(
1 ...
0
votes
1
answer
605
views
HTML in category name
how can edit taxonomy.php in order to stop term sanitizing?
I need HTML (font color) in category name.
Thanks!
0
votes
1
answer
88
views
WP_Customize_Manager: How to get control ID
I have this buggy sanitization function for "select" control:
function sanitize_select( $input, $setting )
{
$input = sanitize_key( $input );
$control = $setting->manager->get_control( $...
0
votes
1
answer
579
views
textarea field is getting escaped for some unknown reason
It doesn't happen outside of WordPress, so I'm posting here.
I'm using a textarea field in a custom form, and before I have a chance to do anything with it, I find it's escaped:
echo $_POST['...
2
votes
0
answers
156
views
Coding a plugin on WordPress; when should I sanitize? [duplicate]
I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
10
votes
1
answer
1k
views
Sanitize and data validation with apply_filters() function
Should we sanitize and validate the apply_filters() like the examples below?
absint( apply_filters( 'slug_excerpt_length', 35 ) );
wp_kses_post( apply_filters( 'slug_excerpt_more', '…' ) );...
2
votes
1
answer
2k
views
Must I serialize/sanitize/escape array data before using set_transient?
Everything is in the question.
For a notices system to show warnings/errors in the admin, I´m using transient.
When I published my first plugin, I received an email to ask me to sanitize/validate/...
1
vote
1
answer
544
views
How to get input_attrs in the sanitize function?
When I try to get input_attrs in the sanitize function I have always errors like:
Trying to get property of non-object in ...
How to do it ?
Thanks in advance.
Control class:
class ...
1
vote
1
answer
392
views
Modify automatically generation of slug when term is created
I need modify the sanitize of slug when a term is created. For example I'm creating a term with name 0,5 and the slug automatically generated is 05. I need to add a dash in the position of the comma, ...
1
vote
0
answers
74
views
Is wp_kses the right approach in sanitizing this string?
I have a function that trims my post title and I escape the final output using wp_kses.
Is this the right approach?
function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' )
{
$title = ...
0
votes
1
answer
841
views
What's a safe / good way to output HTML safely within WordPress templates?
Assume I have a function that returns HTML output after it's done processing it:
function parse_html_for_images() {
return '<img src="' . thumbnail_url() . '">';
}
I need to output this ...
2
votes
2
answers
1k
views
Sanitizing `wp_editor();` Values for Database, Edit, and Display
I'm using custom instances of wp_editor(); to allow rich text editing of Post Meta associated with a Post Object.
I'd like to perform much of the same sanitization that occurs with post_content for ...
1
vote
1
answer
2k
views
Why does wp_redirect strip out %0A (url encoded new line character) and how do I make it stop?
Does this have something to do with sanitization? I need to pass a string as a URL parameter, and that string has \n characters in it. When the URL gets to the client, all other encoding is there (...
1
vote
1
answer
2k
views
How to sanitize my cookie name
guys!
I'm setting a cookie after my Gravity Form is submitted. The name is based on the current page, so each page that has this form will have its own cookie. Some pages with urls ending such as /...
1
vote
1
answer
954
views
WordPress Settings API - Sanitize Integer
I am sanitizing a text field input via a custom WordPress Setting API page like this...
public function current_issue_sanitize($input) {
$sanitary_values = array();
if ( isset( $input['...
4
votes
1
answer
794
views
Shortcode putting html such as <img>
$atts = shortcode_atts( array(
'path' => 'https://s.w.org/about/images/logos/wordpress-logo-simplified-rgb.png'
), $atts);
The above is a part of the shortcode. In Wordpress text ...
7
votes
2
answers
12k
views
How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter
While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
0
votes
1
answer
938
views
How can I apply custom sanitization to new usernames?
I have a WooCommerce module creating Wordpress usernames on my behalf. I want to make sure those usernames are sanitized according to my rules, which are stricter than the Wordpress requirements.
How ...
0
votes
1
answer
267
views
How WordPress sanitizes post content on save? Or it doesn't?
Does WordPress apply any kind of data sanitization for its post content when saving it from admin area? (like stripping <script> tags) Or all it does is checks for some user capability (like ...
0
votes
1
answer
523
views
How do I sanitize the str_replace function in javascript variables
I have the following code in the javascript which outputs the date(s). With backslash for that, I'm replacing those strings with the str_replace to remove backslash, but I can't sanitize that using ...
0
votes
0
answers
159
views
Form Sanitization and Validation
Already asked this on Code Review but no answer there so that's why i'm trying here.
I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
-1
votes
1
answer
2k
views
How to use esc_attr__() function properly to translate a variable that contains string?
I am trying to develop a theme and trying to escape a string using esc_attr__() fuction. Here is how I implemented it.
$title = stoic_get_the_site_title();
echo esc_attr__($title, 'stoic');
But ...
0
votes
1
answer
1k
views
Function sanitize_title() does not appear to be working
I've implemented a stop-gap function that mimics what I believe this function is supposed to be doing, but I would like to use the native libs/functions where possible.
<?php
phpinfo();
...
2
votes
1
answer
212
views
where to apply "apply filters" and other Sanitization Functions
I got to learn something new today here on this post.
I have code written for a Post widget →
<?php
class chimp_post_widget extends WP_Widget {
function __construct() {
...
0
votes
2
answers
88
views
Data not displaying in text field
I have been working on trying to get data to store and display on a CPT field. The code I have is here:
function fhaac_subject_box_callback( $post ){
wp_nonce_field( basename(__FILE__ ), '...
1
vote
1
answer
222
views
Preserve old values on error in setting API
I am trying to preserve old value of form when it fails the validation defined in sanitize callback of register_setting.
But it does not do so, instead it save the default values
register_setting('...
1
vote
1
answer
89
views
Can i use the same sanitize function on multiple theme mod textboxes?
I have a theme mod with multiple options and currently adding sanitizing options to those choices. This is my code I'm using:
$wp_customize->add_section( 'twsa_feed' , array(
'title' => ...
2
votes
2
answers
5k
views
Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database
This adds the field to the add new tag form
function tag_add_form_fields ( $taxonomy ){
?>
<div class="form-field term-colorpicker-wrap">
<label for="term-colorpicker">...
1
vote
0
answers
134
views
Seeking clarity on data sanitization fields for settings textarea
Wanting to learn more about the settings page I wanted to be able to add code such as Google Adsense, Google Analytics and anything code related in a textarea within a custom settings page but I've ...
0
votes
1
answer
106
views
Can we validate data from jquery
Is it ok, to validate some data using jquery?
I am working on a plugin which has repeater fields in widgets, so my plan was to convert all repeater field data in json when user clicks on save button. ...
1
vote
1
answer
160
views
What functions does WordPress use for filtering / sanitizing comments?
We have some custom built comments (ones tied to custom post types, that we can't integrate with WP's comment system). But we want to filter the comments when they are submitted the way WP does and ...
10
votes
4
answers
10k
views
Sanitize content from wp_editor
I built a custom post type where we can find a standard textarea/tinymce generated by wp_editor() and I'm facing an issue for the saving part.
If I save the content with the following code :
...
1
vote
0
answers
298
views
Customizer: Category Select Sanitize
as a noob I managed out to create a custom selectbox control for categories in customizer.
But now I am trying to find a clever 'sanitize_callback' function in order to ensure security. Here is my ...
2
votes
1
answer
1k
views
Escape hexadecimals/rgba values
I know that sanitize_hex_color exists for sanitizing hexadecimal values going into the database (and only exists in the Customizer), but what's the best function to escape those same values. Should I ...
10
votes
2
answers
841
views
Escaping and sanitizing SVGs in metabox textarea
I want to include inline SVGs in a metabox textarea.
That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it?
Halp?
Thanks!
2
votes
1
answer
616
views
Prevent invalid or empty values from being saved to the database and retain the form field values upon error
I'm using the Settings API to save the settings of my plugin. I want a positive integer value from the settings field.
register_setting( $option_group, $option_name . '_number', '...
7
votes
1
answer
2k
views
Should nonce be sanitized?
The general guideline is that we should sanitize all user input before using them.
Now my questions is whether this applies to nonce or not.
Which one is correct?
wp_verify_nonce( ...
1
vote
1
answer
40
views
data (html) migration to posts
Thank you, up front for taking the time to look into my problem.
I have around 605 posts I extracted from a database of a site that was running on ruby on rails. I converted the data into JSON which ...
1
vote
1
answer
166
views
Who is responsible for data sanitization in WordPress development?
I am studying how to write more secure WordPress code by implementing validation, sanitization and data escaping wherever necessary. Validation and escaping makes perfect sense, but I am a little ...
2
votes
1
answer
360
views
Is it sensible to worry about sanitizing admin input in plugin custom CSS?
In numerous plugins and themes, developers will provide an option for Admin-level users to enter their own additional CSS (for the sake, obviously, of customizing output). Some plugins and themes also ...
1
vote
2
answers
1k
views
Best Practice for Validating and Sanitizing Data
I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly.
To process the data, ...
2
votes
2
answers
11k
views
How to save html and text in the database?
I have two fields. The first is for plain text (but with special characters) and the second for html content (wp_editor is used). Both are later needed for phpmailer.
<textarea style="width:100%;...
0
votes
1
answer
76
views
Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
There is a tutorial on TutsPlus →
https://code.tutsplus.com/articles/data-sanitization-and-validation-with-wordpress--wp-25536
Rule No. 4: Making Data Safe Is About Context
They says that this is ...
1
vote
1
answer
68
views
What is the safe way to print tracking code / pixel code before </head> tag or </body> tag
What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options.
In header.php I printed the following code before the </head> tag
if (...