Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

Sanitization of register_setting()

How to do sanitization at register_setting() ? I am learning Plugin Development. I am using below code. public function settings_page_registration() { register_setting( '...
abu abu's user avatar
  • 203
1 vote
1 answer
25 views

How to sanitize settings API value

I am working on a Plugin. I am using Settings API like below. register_setting( 'sports_api_key', 'sports_api_key' ); How can I sanitize settings API Text value here ?
abu abu's user avatar
  • 203
0 votes
1 answer
44 views

Sanitize a custom date meta field

I have to sanitize the following <input type="date" id="periodo_1da" name="periodo_1da" class="list_prezzi" ><?php echo esc_attr( get_the_author_meta( '...
Andrea Sacconi's user avatar
2 votes
1 answer
204 views

What is the proper way to sanitize $_POST and $_GET vars?

I am trying to understand the proper way to sanitize data in different situations. If I understand correctly, WordPress automatically applies a wp_slash() on the global $_POST variable: should this ...
KouiK's user avatar
  • 33
0 votes
1 answer
253 views

Does it make sense to sanitize the output of an SVG file?

I'm developing a plugin. In its settings page I want to use SVG icons. This is how I render SVG icons: <div class="svg-wrap"> <?php echo file_get_contents(ABSPATH . 'wp-content/...
Megumi's user avatar
  • 1
0 votes
0 answers
31 views

1st dynamic table row content is not saved on initial update

This is what is used in my plugin. A meta field that allows the user in a page editor to add table rows and three columns. As many rows as needed. The issue I am facing is I add a row, then populate ...
Chris Parsons's user avatar
1 vote
0 answers
34 views

Extend file format support for post thumbnails

I am trying to enable video thumbnails for posts in my theme. I created a custom post thumbnail media uploader in an editor plugin as follows (This is necessary, because the default uploader can't ...
TimMKuehle's user avatar
0 votes
1 answer
111 views

how to sanitizing $_POST with the correct way?

I am trying to sanitize and validate and escape this code? $positions = $_POST['positions']; foreach ($positions as $key => $position) { $id = sanitize_text_field($position[0]); ...
crazybuilding's user avatar
0 votes
1 answer
797 views

esc_url, esc_url_raw or sanitize_url?

I know there's already this post here but its answers still leave me in the dark about these three methods. I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
DevelJoe's user avatar
  • 487
0 votes
1 answer
62 views

Properly sanitize an input field "Name <[email protected]>"

In my plugin I want administrators to be able to set the from name and email address in a single form field. I anticipate the field content to be Name <[email protected]> However both ...
Steve's user avatar
  • 297
0 votes
0 answers
43 views

How to return responsive images from a sanitize_callback?

I'm trying to sanitize the images of the customizer from my theme. I found an example on this topic and it works, but makes my template stop showing the image. With a var_dump(), I found out that the ...
Natália's user avatar
0 votes
1 answer
133 views

How can I properly sanitize the update_option in WordPress?

I am using this part of the code in my WordPress plugin to update the option. update_option('button_loc_shop_page', $_POST['button_loc_shop_page']); I want to sanitize this. How can I properly ...
Rajin Sharwar's user avatar
1 vote
1 answer
202 views

oneOf two possible objects in WP REST API?

I'm trying to define an endpoint that accepts two possible objects upon input, and currently tried to do so via: 'args' => [ 'type' => 'object',...
DevelJoe's user avatar
  • 487
0 votes
1 answer
188 views

HTML Img with data:image src gets sanitized in admin?

In the WordPress admin panel (dashboard), I want to add an image inside an ACF field description. Since it's a simple SVG icon, I want to load it using <img src="data:image/svg+xml..." /&...
Shahriar's user avatar
  • 175
0 votes
1 answer
765 views

Sanitizing URL in a WordPress plugin

I am trying to get the current page url which require the use of $_SERVER["REQUEST_URI"]. The point is how do I need to sanitize the returned URL? I tried to use sanitize_url( string $url, ...
ehab's user avatar
  • 1
0 votes
1 answer
45 views

How to allow certain PHP functions when using sanitize_callback in the word press customizer

Hi I am making my own theme in WordPress and setting up some customizer options and I have one for the text in my footer but I would like to still use <? echo date('Y');?> in the footer to ...
besty_01's user avatar
2 votes
2 answers
3k views

wpdb get_results() and prepare when to use prepare?

so if i have a function that gets terms from the database ( not the user ) do I need to use prepare first ( before get_results() ), or some sort of data sanitizing?
challenge2022's user avatar
1 vote
1 answer
148 views

Cannot get 'sanitize_callback' to work for rest parameters

I'm trying to sanitize my rest parameters using sanitize_callback: register_rest_route( SoundSystem::$rest_namespace, '/playlist/new', array( 'methods' => WP_REST_Server::CREATABLE, 'callback' =...
gordie's user avatar
  • 492
1 vote
1 answer
490 views

Settings API - sanitize_callback is not called and it leads to an incorrect behavior

I am in the process of creating some options / the options page for my plugin. In the context of this I have only added two checkboxes so far to store boolean values. The creation, display on the page ...
Sven Rösser's user avatar
2 votes
1 answer
773 views

Sanitize array callback for the WordPress Settings API

I am used to register plugin settings like this: $string_sanitization = array( 'sanitize_callback' => 'sanitize_text_field', ); // Section Setting: Just some example string register_setting( ...
Álvaro Franz's user avatar
3 votes
0 answers
2k views

Correct processing of `$_POST`, following WordPress Coding Standards

Background I'm building a project that according to the specifications need to follow the WordPress Coding Standards. I am using phpcs to scan my code. If I try to pass $_POST-data into a function ...
Fabian Mossberg's user avatar
0 votes
2 answers
479 views

Do I need to sanitize $_POST['keyword'] before send to 's' parameter?

Anyone know how to sanitize the $_POST for wordpress? $args = array( 's' => esc_attr( $_POST['keyword'] ), );
user205932's user avatar
8 votes
3 answers
2k views

Does WordPress sanitize arguments to WP_Query?

This is a very straight-forward question, but it's important and I can't find anything definitive in the docs. This question asks a similar question for the 's' parameter, specifically. I want to know ...
emersonthis's user avatar
  • 1,327
2 votes
1 answer
384 views

Sanitizing comments or escaping comment_text()

I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
p01ntbr34k's user avatar
0 votes
1 answer
47 views

Input sanitation

I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
snookian's user avatar
  • 155
1 vote
1 answer
886 views

Sanitizing, Validating and Escaping in WordPress (Plugin)

I am currently developing my first WordPress plugin. A few days ago I submitted it to WordPress for review. Unfortunately, the plugin was not (yet) published, because I still have to close some ...
Jonas's user avatar
  • 159
4 votes
1 answer
1k views

Should I sanitize custom post meta if it is going to be escaped later?

Firstly, sorry if this has been properly answered before. After reading a lot of questions and guides, I'm still not totally convinced on the best way of doing things. I understand the basics of XSS- ...
Tysss's user avatar
  • 43
0 votes
0 answers
256 views

Can non-latin characters appear in slugs?

For a non-latin category name such as "我的种类", the slug generated is "%e6%88%91%e7%9a%84%e7%a7%8d%e7%b1%bb". What function does Wordpress use to generate this slug? Can I directly ...
William's user avatar
  • 103
4 votes
1 answer
1k views

What is the proper way to validate and sanitize JSON response from REST API?

I have read the WordPress page about this but didn't find a solution. Here are my details: register rest route: register_rest_route( '/jwt-auth/v1', '/user', array( 'methods' ...
b3hr4d's user avatar
  • 161
0 votes
1 answer
60 views

Wordpress messes up with data attributes in shortcode output

I have build a shortcode to insert a call to action text and button/link. The button/link should open a modal window with a contact form. So I added data attributes to the button/link for Bootstrap ...
AdSim's user avatar
  • 21
1 vote
1 answer
36 views

MITM risk of not sanitizing?

The plugin review team has rejected my plugin because they say I'm not sanitizing data. Here is the snippet: function add_cookie_to_order( $order_id ) { if ( isset( $_COOKIE['tm_clickid'] ) &&...
the_nuts's user avatar
  • 131
0 votes
1 answer
457 views

How to escape $_GET and check if isset?

I submitted a plugin to wordpress and I got a feedback that I have to escape this one $active_tab = isset( $_GET[ 'tab' ] ) ? $_GET[ 'tab' ] : 'front_page_options'; If I do like $get_the_param = ...
user avatar
1 vote
1 answer
355 views

Copy content stored in meta to post content

I'm working on a site that had an existing theme that used meta fields to store blocks (bad practice IMO but pre-block editor). The problem is there are over 300 posts and all the different "...
themattyg's user avatar
0 votes
2 answers
1k views

Display the line breaks in user bio without using html

User fills their user bio using Formidable forms. It saves correctly and displays with line breaks in Worpdress admin on the user overview page. It displays without line breaks on the site. The only ...
Adrian Nutiu's user avatar
0 votes
0 answers
765 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
JohnRDOrazio's user avatar
0 votes
1 answer
92 views

Trouble matching strings (titles) using wp_query

I'm repairing an old site on which we match the titles of two types of posts to link them together. There is a wp_query which uses 'title' => get_the_title() to do this, but it only works some of ...
byzantine cucumber's user avatar
0 votes
1 answer
1k views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
suiz's user avatar
  • 101
2 votes
1 answer
2k views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
sazr's user avatar
  • 357
0 votes
1 answer
1k views

Sanitize user input fields before wp_insert_post

I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags. However, I'm new to development and would like to be confirmed ...
hiyo's user avatar
  • 35
0 votes
1 answer
402 views

Change user nicename without sanitize

How to remove sanitize from edit_user_profile action? I have a possibility to change user_nicename with the following code: function ex_insert_nicename_input( $user ) { $content = ob_get_clean();...
Alexander Goroshev's user avatar
1 vote
1 answer
618 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
Petr Cibulka's user avatar
0 votes
1 answer
809 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
BuddyHoli's user avatar
3 votes
2 answers
2k views

WP Coding standards - escaping the inescapable?

How do you escape these two examples? wc_price() wraps the already escaped $product_price in p and span tags with currency symbol. $product_price = $product->get_price(); <p><?php echo ...
Bonovski's user avatar
2 votes
2 answers
4k views

What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?

I need to sanitize some custom settings added with the Customize API, namely some simple text fields. Other data types have some dedicated functions, i.e. email addresses should use sanitize_email(), ...
Sekhemty's user avatar
  • 141
0 votes
1 answer
201 views

How to escape html generate by a loop

I have the following code which is flagging a warning that I've been asked to fix by my theme reviewer. WARNING All output should be run through an escaping function (see the Security sections in the ...
Steven Gardner's user avatar
4 votes
1 answer
395 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
Sean's user avatar
  • 647
0 votes
0 answers
110 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
user avatar
1 vote
1 answer
2k views

Is it necessary to sanitize wp_set_password user input?

I'm trying to add a password form to the WP registration form. See the code below. I was wondering if I need to sanitize this specific user input? (and if so how?) If I understand it correctly, WP ...
J. Stockland's user avatar
0 votes
1 answer
95 views

confused about sanitize_email after is_email [duplicate]

Assume I have checked an email using is_email and the result is true, should I sanitize with sanitize_email? if yes, then why?
Makiomar's user avatar
  • 151
2 votes
2 answers
2k views

array_map() for sanitizing $_POST

I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
colbyalbo's user avatar

1
2 3 4 5