Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

43 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
129 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
5
votes
1answer
108 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
2
votes
1answer
76 views

where to apply “apply filters” and other Sanitization Functions

I got to learn something new today here on this post. I have code written for a Post widget → <?php class chimp_post_widget extends WP_Widget { function __construct() { ...
1
vote
0answers
185 views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
1
vote
0answers
24 views

Is wp_kses the right approach in sanitizing this string?

I have a function that trims my post title and I escape the final output using wp_kses. Is this the right approach? function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' ) { $title = ...
1
vote
1answer
2k views

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
1
vote
0answers
82 views

Seeking clarity on data sanitization fields for settings textarea

Wanting to learn more about the settings page I wanted to be able to add code such as Google Adsense, Google Analytics and anything code related in a textarea within a custom settings page but I've ...
1
vote
0answers
193 views

Customizer: Category Select Sanitize

as a noob I managed out to create a custom selectbox control for categories in customizer. But now I am trying to find a clever 'sanitize_callback' function in order to ensure security. Here is my ...
1
vote
1answer
90 views

Prevent invalid or empty values from being saved to the database and retain the form field values upon error

I'm using the Settings API to save the settings of my plugin. I want a positive integer value from the settings field. register_setting( $option_group, $option_name . '_number', '...
1
vote
1answer
54 views

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options. In header.php I printed the following code before the </head> tag if (...
1
vote
1answer
390 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
1
vote
0answers
90 views

Theme Customizier sanitize_callback not working

I have a theme option to set the slider speed. The sanitize_callback function is not working. I would like the function to set the speed to 4000ms if a non numeric character is entered. function ...
1
vote
1answer
335 views

Data Validation: Always escape late / escape HTML Code

I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late" I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved ...
1
vote
0answers
2k views

sanitize_text_field and apostrophe problem

I've written a custom plugin to send data via a form to a personal database, different from the WP one. Everything is working fine except the fact that when you write a name, for example D'ALESSANDRO, ...
1
vote
0answers
59 views

Change wp_sanitize function?

I have a domain name like sép. wp_sanitize functions clears the écharacter. I would like to change it, but I cannot redeclare in functions.php. Is it possible to change, or WordPress cannot run ...
1
vote
0answers
293 views

Multiple register settings, with same option name - issue

I already posted this question in wordpress support forums here but I didn't get any help and nor could I find a solution yet. As the title says, I am calling register_settings functions multiple ...
1
vote
0answers
25 views

What data sanitzation function should be used to store entire source code of webpage?

What is the best data santization function to use when the entire source code of a webpage (head, body elements, etc) are going to be stored in a post meta field? In other words, which function will ...
1
vote
2answers
460 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
1
vote
0answers
102 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
1answer
92 views

What functions does WordPress use for filtering / sanitizing comments?

We have some custom built comments (ones tied to custom post types, that we can't integrate with WP's comment system). But we want to filter the comments when they are submitted the way WP does and ...
0
votes
0answers
10 views

Visual Composer: Backend param value sanitation

Is there a way to sanitize the value saved from an element param in the visual composer? I have a custom param that ends up having a JSON value. I want to transform that JSON into a PHP array on save....
0
votes
0answers
17 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. I have an IF in ...
0
votes
0answers
18 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
2answers
33 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
0answers
12 views

Custom Customizer Image Sanitize fails to update image

I use this custom sanitizer to get the appropriate image size so that anyone using my themes can't mess up and put an 8k image in the website. The code works, but the problem I have is that once the ...
0
votes
2answers
38 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
0
votes
0answers
47 views

Form Sanitization and Validation

Already asked this on Code Review but no answer there so that's why i'm trying here. I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
0
votes
1answer
429 views

function sanitize_title() does not appear to be working

Spent quite a while trying to figure this out. I've implemented a stop-gap function that mimics what I believe this function is supposed to be doing, but I would like to use the native libs/functions ...
0
votes
2answers
82 views

Data not displaying in text field

I have been working on trying to get data to store and display on a CPT field. The code I have is here: function fhaac_subject_box_callback( $post ){ wp_nonce_field( basename(__FILE__ ), '...
0
votes
1answer
48 views

Preserve old values on error in setting API

I am trying to preserve old value of form when it fails the validation defined in sanitize callback of register_setting. But it does not do so, instead it save the default values register_setting('...
0
votes
1answer
26 views

Can we validate data from jquery

Is it ok, to validate some data using jquery? I am working on a plugin which has repeater fields in widgets, so my plan was to convert all repeater field data in json when user clicks on save button. ...
0
votes
2answers
487 views

Best Practice for Validating and Sanitizing Data

I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly. To process the data, ...
0
votes
1answer
111 views

Sanitizing output that contains quotes?

I have a variable that picks up data from the theme settings like background image and such, and it's stored in a separate file with inline style like: $style = 'style="'.$background_image.$...
0
votes
1answer
83 views

Array/List Edit in Backend

I'm kinda new to WordPress Development and even thought the question seems extremely easy for me, I haven't found any solution that works for me. My Plugin uses a option to store a simple array of "...
0
votes
0answers
78 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
1answer
341 views

What function removes apostrophes when making a slug?

I am trying to convert a post title to a slug. I used sanitize_title_with_dashes, thinking that's what WordPress uses. However, if my post title has an apostrophe in it, sanitize_title_with_dashes ...
0
votes
1answer
387 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($...
0
votes
1answer
274 views

Sanitization html output itself

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a ...
0
votes
0answers
324 views

Sanitize html, where to sanitize

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code: functions.php function zz_style($properties, $values) { $styles_array = array(); ...
0
votes
1answer
273 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** *-----------...
0
votes
1answer
524 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
1answer
84 views

Sanitizing a custom query's clauses

I'm trying to build a custom query much like the one found in WordPress' native get_posts() inside wp-includes/query.php, meaning something along these lines: global $wpdb SELECT * FROM $wpdb->...
-1
votes
1answer
131 views

Is it sensible to worry about sanitizing admin input in plugin custom CSS?

In numerous plugins and themes, developers will provide an option for Admin-level users to enter their own additional CSS (for the sake, obviously, of customizing output). Some plugins and themes also ...