Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

49 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
206 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
5
votes
1answer
120 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
2
votes
1answer
126 views

where to apply “apply filters” and other Sanitization Functions

I got to learn something new today here on this post. I have code written for a Post widget → <?php class chimp_post_widget extends WP_Widget { function __construct() { ...
2
votes
1answer
391 views

Data Validation: Always escape late / escape HTML Code

I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late" I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved ...
1
vote
1answer
51 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
1
vote
0answers
64 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
1
vote
0answers
33 views

Is wp_kses the right approach in sanitizing this string?

I have a function that trims my post title and I escape the final output using wp_kses. Is this the right approach? function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' ) { $title = ...
1
vote
0answers
94 views

Seeking clarity on data sanitization fields for settings textarea

Wanting to learn more about the settings page I wanted to be able to add code such as Google Adsense, Google Analytics and anything code related in a textarea within a custom settings page but I've ...
1
vote
0answers
240 views

Customizer: Category Select Sanitize

as a noob I managed out to create a custom selectbox control for categories in customizer. But now I am trying to find a clever 'sanitize_callback' function in order to ensure security. Here is my ...
1
vote
1answer
141 views

Prevent invalid or empty values from being saved to the database and retain the form field values upon error

I'm using the Settings API to save the settings of my plugin. I want a positive integer value from the settings field. register_setting( $option_group, $option_name . '_number', '...
1
vote
1answer
58 views

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options. In header.php I printed the following code before the </head> tag if (...
1
vote
1answer
450 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
1
vote
0answers
94 views

Theme Customizier sanitize_callback not working

I have a theme option to set the slider speed. The sanitize_callback function is not working. I would like the function to set the speed to 4000ms if a non numeric character is entered. function ...
1
vote
0answers
2k views

sanitize_text_field and apostrophe problem

I've written a custom plugin to send data via a form to a personal database, different from the WP one. Everything is working fine except the fact that when you write a name, for example D'ALESSANDRO, ...
1
vote
0answers
70 views

Change wp_sanitize function?

I have a domain name like sép. wp_sanitize functions clears the écharacter. I would like to change it, but I cannot redeclare in functions.php. Is it possible to change, or WordPress cannot run ...
1
vote
0answers
325 views

Multiple register settings, with same option name - issue

I already posted this question in wordpress support forums here but I didn't get any help and nor could I find a solution yet. As the title says, I am calling register_settings functions multiple ...
1
vote
0answers
27 views

What data sanitzation function should be used to store entire source code of webpage?

What is the best data santization function to use when the entire source code of a webpage (head, body elements, etc) are going to be stored in a post meta field? In other words, which function will ...
1
vote
2answers
566 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
1
vote
0answers
102 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
1answer
102 views

What functions does WordPress use for filtering / sanitizing comments?

We have some custom built comments (ones tied to custom post types, that we can't integrate with WP's comment system). But we want to filter the comments when they are submitted the way WP does and ...
0
votes
0answers
14 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
0
votes
1answer
14 views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
0
votes
0answers
11 views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
0
votes
0answers
56 views

how to sanitize, store and restore a regex pattern string?

I'm writing a plugin and I need to store "complex" strings, among others regex patterns, eg. (?:&#8216;|&#8220;)(.*)(?:&#8217;|&#8221;) There might also have html tags in there. ...
0
votes
1answer
22 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
0
votes
0answers
11 views

Sanitize Wordpress custom Post Type metabox not working or saving when using the funcitn wp_kses

if ( isset( $_POST['cloudlyup_maulti_location_gmap_fields'] )){ $old = get_post_meta( $post_id, 'cloudlyup_maulti_location_gmap_fields', true ); $new = sanitize_meta( '...
0
votes
0answers
29 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
0
votes
0answers
53 views

Sanitizing array in wordpress options page

I have an array like this [select_post_template_repeater] => Array ( [0] => Array ( [0] => post [template] => ...
0
votes
0answers
30 views

ACF plugin how to correctly escape $_GET variables before dumping them into a query

I found this code in the Advanced Custom Fields documentation and everything works. My concern is a comment on the original post saying the code was open to SQL injection because it doesn't properly '...
0
votes
0answers
15 views

Visual Composer: Backend param value sanitation

Is there a way to sanitize the value saved from an element param in the visual composer? I have a custom param that ends up having a JSON value. I want to transform that JSON into a PHP array on save....
0
votes
0answers
35 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. This all works ...
0
votes
0answers
22 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
2answers
51 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
2answers
101 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
0
votes
0answers
62 views

Form Sanitization and Validation

Already asked this on Code Review but no answer there so that's why i'm trying here. I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
0
votes
2answers
83 views

Data not displaying in text field

I have been working on trying to get data to store and display on a CPT field. The code I have is here: function fhaac_subject_box_callback( $post ){ wp_nonce_field( basename(__FILE__ ), '...
0
votes
1answer
98 views

Preserve old values on error in setting API

I am trying to preserve old value of form when it fails the validation defined in sanitize callback of register_setting. But it does not do so, instead it save the default values register_setting('...
0
votes
1answer
30 views

Can we validate data from jquery

Is it ok, to validate some data using jquery? I am working on a plugin which has repeater fields in widgets, so my plan was to convert all repeater field data in json when user clicks on save button. ...
0
votes
2answers
751 views

Best Practice for Validating and Sanitizing Data

I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly. To process the data, ...
0
votes
1answer
85 views

Array/List Edit in Backend

I'm kinda new to WordPress Development and even thought the question seems extremely easy for me, I haven't found any solution that works for me. My Plugin uses a option to store a simple array of "...
0
votes
0answers
110 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
1answer
456 views

What function removes apostrophes when making a slug?

I am trying to convert a post title to a slug. I used sanitize_title_with_dashes, thinking that's what WordPress uses. However, if my post title has an apostrophe in it, sanitize_title_with_dashes ...
0
votes
1answer
466 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($...
0
votes
1answer
390 views

Sanitization html output itself

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a ...
0
votes
0answers
345 views

Sanitize html, where to sanitize

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code: functions.php function zz_style($properties, $values) { $styles_array = array(); ...
0
votes
1answer
297 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** *-----------...
0
votes
1answer
569 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
1answer
108 views

Sanitizing a custom query's clauses

I'm trying to build a custom query much like the one found in WordPress' native get_posts() inside wp-includes/query.php, meaning something along these lines: global $wpdb SELECT * FROM $wpdb->...
-1
votes
1answer
195 views

Is it sensible to worry about sanitizing admin input in plugin custom CSS?

In numerous plugins and themes, developers will provide an option for Admin-level users to enter their own additional CSS (for the sake, obviously, of customizing output). Some plugins and themes also ...