Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
1
vote
2answers
576 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
0
votes
1answer
570 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
2
votes
4answers
61k views

How to display data from custom table in wordpress database?

I want to retrieve data from custom table, that I've made inside the wordpress database and display it in a wordpress page , like posts Thanks in advance
0
votes
0answers
26 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
0
votes
1answer
31 views

Trouble matching strings (titles) using wp_query

I'm repairing an old site on which we match the titles of two types of posts to link them together. There is a wp_query which uses 'title' => get_the_title() to do this, but it only works some of ...
0
votes
1answer
16 views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
0
votes
0answers
12 views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
2
votes
1answer
450 views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
0
votes
1answer
30 views

Sanitize user input fields before wp_insert_post

I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags. However, I'm new to development and would like to be confirmed ...
0
votes
1answer
34 views

Change user nicename without sanitize

How to remove sanitize from edit_user_profile action? I have a possibility to change user_nicename with the following code: function ex_insert_nicename_input( $user ) { $content = ob_get_clean();...
2
votes
2answers
317 views

Sanitizing post content for use in an email

I'm sending the content of a custom post type in a plain text email (it's to send competition entries to a panel of judges), so I need to make sure that $post->post_content is correctly sanitized ...
0
votes
1answer
472 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($...
1
vote
1answer
65 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
0
votes
2answers
775 views

Best Practice for Validating and Sanitizing Data

I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly. To process the data, ...
0
votes
0answers
62 views

how to sanitize, store and restore a regex pattern string?

I'm writing a plugin and I need to store "complex" strings, among others regex patterns, eg. (?:&#8216;|&#8220;)(.*)(?:&#8217;|&#8221;) There might also have html tags in there. ...
2
votes
2answers
6k views

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
1
vote
1answer
3k views

Sanitizing search data for use with WP_Query

I'm using heavily-customised WordPress to drive a fishkeeping website. I have two separate search areas: a site-wide search and a fish species search. The latter also has advanced search features ...
0
votes
1answer
26 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
1
vote
2answers
62 views

WP Coding standards - escaping the inescapable?

How do you escape these two examples? wc_price() wraps the already escaped $product_price in p and span tags with currency symbol. $product_price = $product->get_price(); <p><?php echo ...
0
votes
0answers
11 views

Sanitize Wordpress custom Post Type metabox not working or saving when using the funcitn wp_kses

if ( isset( $_POST['cloudlyup_maulti_location_gmap_fields'] )){ $old = get_post_meta( $post_id, 'cloudlyup_maulti_location_gmap_fields', true ); $new = sanitize_meta( '...
6
votes
3answers
6k views

Sanitizing integer input for update_post_meta

When updating a post meta where the input will be always an integer, should I use (int) or is there a WordPress function for that (eg. sanitize_text_field)? For example: if(isset($_POST['category_id'...
1
vote
2answers
292 views

What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?

I need to sanitize some custom settings added with the Customize API, namely some simple text fields. Other data types have some dedicated functions, i.e. email addresses should use sanitize_email(), ...
0
votes
1answer
48 views

How to escape html generate by a loop

I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer. WARNING All output should be run through an escaping function (see the Security sections in the ...
1
vote
1answer
461 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
0
votes
1answer
633 views

Function sanitize_title() does not appear to be working

I've implemented a stop-gap function that mimics what I believe this function is supposed to be doing, but I would like to use the native libs/functions where possible. <?php phpinfo(); ...
0
votes
2answers
279 views

Sanitizing output that contains quotes?

I have a variable that picks up data from the theme settings like background image and such, and it's stored in a separate file with inline style like: $style = 'style="'.$background_image.$...
1
vote
0answers
71 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
0
votes
0answers
43 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. This all works ...
0
votes
0answers
31 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
0
votes
0answers
53 views

Sanitizing array in wordpress options page

I have an array like this [select_post_template_repeater] => Array ( [0] => Array ( [0] => post [template] => ...
0
votes
1answer
215 views

Is it necessary to sanitize wp_set_password user input?

I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?) If I understand it correctly, WP ...
0
votes
1answer
40 views

confused about sanitize_email after is_email [duplicate]

Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?
0
votes
0answers
32 views

ACF plugin how to correctly escape $_GET variables before dumping them into a query

I found this code in the Advanced Custom Fields documentation and everything works. My concern is a comment on the original post saying the code was open to SQL injection because it doesn't properly '...
2
votes
2answers
334 views

array_map() for sanitizing $_POST

I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
6
votes
1answer
217 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
1
vote
2answers
3k views

Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database

This adds the field to the add new tag form function tag_add_form_fields ( $taxonomy ){ ?> <div class="form-field term-colorpicker-wrap"> <label for="term-colorpicker">...
0
votes
3answers
5k views

What's the proper way to sanitize checkbox value sent to the database

I have tried using sanitize_text_field() and esc_attr() to filter checkbox data when saving their values to the database, but it is causing the data not being saved. What is causing it and what's the ...
0
votes
1answer
123 views

Sanitize $_GET variable when comparing

I know when I want to save data in database, I must sanitize data but what about following case which is a simple comparison. Should I sanitize? if ( ! isset( $_GET['page'] ) ) { return; } ...
0
votes
1answer
25 views

Does meta-data need to be sanitized?

Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use ...
3
votes
3answers
993 views

WP doesn't show Array Custom Fields?

I'm wondering why WordPress doesn't list PHP array() and any serialized data in Custom Fields in Admin Panel (for Pages, Posts etc.)? Only Custom Fields containing strings and numbers show up and can ...
0
votes
0answers
22 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
1answer
93 views

do I need to sanitize a shortcode's function input?

I'm using the following custom plugin to count the number of members in the MemberPress database: function display_member_count( $atts ) { global $wpdb; $sql = "SELECT COUNT(`meta_key`) as ...
0
votes
2answers
59 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
2answers
108 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
0
votes
1answer
159 views

HTML in category name

how can edit taxonomy.php in order to stop term sanitizing? I need HTML (font color) in category name. Thanks!
0
votes
1answer
30 views

WP_Customize_Manager: How to get control ID

I have this buggy sanitization function for "select" control: function sanitize_select( $input, $setting ) { $input = sanitize_key( $input ); $control = $setting->manager->get_control( $...
8
votes
4answers
5k views

Sanitize content from wp_editor

I built a custom post type where we can find a standard textarea/tinymce generated by wp_editor() and I'm facing an issue for the saving part. If I save the content with the following code : ...
11
votes
2answers
6k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., &...
0
votes
1answer
38 views

textarea field is getting escaped for some unknown reason

It doesn't happen outside of WordPress, so I'm posting here. I'm using a textarea field in a custom form, and before I have a chance to do anything with it, I find it's escaped: echo $_POST['...
20
votes
4answers
18k views

Is sanitize_title enough to generate post slugs?

I want to generate slug for some strings without going through WordPress slug generation flow. Therefore, I want to know which functions it calls to get a neat slug. I tried sanitize_title() but it ...