Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
217 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
5
votes
1answer
123 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
2
votes
1answer
129 views

where to apply “apply filters” and other Sanitization Functions

I got to learn something new today here on this post. I have code written for a Post widget → <?php class chimp_post_widget extends WP_Widget { function __construct() { ...
2
votes
1answer
398 views

Data Validation: Always escape late / escape HTML Code

I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late" I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved ...
1
vote
1answer
65 views

remove_accents does not seem to work (when used inside sanitize_file_name filter)

I am trying to automatically remove accents from uploaded files through WP administration. This is my current approach (functions.php): add_filter('sanitize_file_name', function($filename) { ...
1
vote
0answers
70 views

Is there an equivalent of the PHP function sanitize_key in Gutenberg?

In WordPress's PHP library there is a function sanitize_key used to generate database keys and HTML IDs. I'd like to generate a slug from a title that can be used as an HTML ID, from within a ...
1
vote
0answers
34 views

Is wp_kses the right approach in sanitizing this string?

I have a function that trims my post title and I escape the final output using wp_kses. Is this the right approach? function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' ) { $title = ...
1
vote
0answers
96 views

Seeking clarity on data sanitization fields for settings textarea

Wanting to learn more about the settings page I wanted to be able to add code such as Google Adsense, Google Analytics and anything code related in a textarea within a custom settings page but I've ...
1
vote
0answers
245 views

Customizer: Category Select Sanitize

as a noob I managed out to create a custom selectbox control for categories in customizer. But now I am trying to find a clever 'sanitize_callback' function in order to ensure security. Here is my ...
1
vote
1answer
145 views

Prevent invalid or empty values from being saved to the database and retain the form field values upon error

I'm using the Settings API to save the settings of my plugin. I want a positive integer value from the settings field. register_setting( $option_group, $option_name . '_number', '...
1
vote
1answer
58 views

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options. In header.php I printed the following code before the </head> tag if (...
1
vote
1answer
461 views

Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break

I have been unable to figure out how I can properly sanitize (in the customizer) and escape (in the theme, while allowing the user to use "<" and ">" to insert a '< br >' and add a line break ...
1
vote
0answers
95 views

Theme Customizier sanitize_callback not working

I have a theme option to set the slider speed. The sanitize_callback function is not working. I would like the function to set the speed to 4000ms if a non numeric character is entered. function ...
1
vote
0answers
2k views

sanitize_text_field and apostrophe problem

I've written a custom plugin to send data via a form to a personal database, different from the WP one. Everything is working fine except the fact that when you write a name, for example D'ALESSANDRO, ...
1
vote
0answers
72 views

Change wp_sanitize function?

I have a domain name like sép. wp_sanitize functions clears the écharacter. I would like to change it, but I cannot redeclare in functions.php. Is it possible to change, or WordPress cannot run ...
1
vote
0answers
336 views

Multiple register settings, with same option name - issue

I already posted this question in wordpress support forums here but I didn't get any help and nor could I find a solution yet. As the title says, I am calling register_settings functions multiple ...
1
vote
0answers
27 views

What data sanitzation function should be used to store entire source code of webpage?

What is the best data santization function to use when the entire source code of a webpage (head, body elements, etc) are going to be stored in a post meta field? In other words, which function will ...
1
vote
2answers
575 views

CSS from textarea in options page to frontend what to do

I have a textarea for small css enhancements on the plugins page i output them directly to the head. My Question is how to sanitize the CSS i have validation function registered for the options with ...
1
vote
0answers
102 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
1answer
106 views

What functions does WordPress use for filtering / sanitizing comments?

We have some custom built comments (ones tied to custom post types, that we can't integrate with WP's comment system). But we want to filter the comments when they are submitted the way WP does and ...
0
votes
0answers
26 views

how to sanitize customizer checkbox control

When trying to use a sanitization callback for a value which I would like to store as boolean, I keep getting an error in the Customizer saying "Invalid input" for a checkbox (the error appears almost ...
0
votes
1answer
16 views

Sanitize WordPress Array Input?

I have a form that submits the data in array format. I have sanitized all the data and also tried to escape it using esc_attr, but it is a function of escaping and not sanitizing. Is there a better ...
0
votes
0answers
12 views

Which escape function to use when escaping an email or plain text?

I have submitted a plugin to the WordPress repo, they have come back and said I need to escape the values in my email sending code NOT sanitize. So I'm confused what function they want me to use. Can ...
0
votes
0answers
61 views

how to sanitize, store and restore a regex pattern string?

I'm writing a plugin and I need to store "complex" strings, among others regex patterns, eg. (?:&#8216;|&#8220;)(.*)(?:&#8217;|&#8221;) There might also have html tags in there. ...
0
votes
1answer
26 views

How to save Checkbox-Options in Plugin Options Page

First of all: I am really a newbie. So I used a template for my options page and tried to customize it (works pretty good so far). About my plugin: It creates to post types and some meta boxes ...
0
votes
0answers
11 views

Sanitize Wordpress custom Post Type metabox not working or saving when using the funcitn wp_kses

if ( isset( $_POST['cloudlyup_maulti_location_gmap_fields'] )){ $old = get_post_meta( $post_id, 'cloudlyup_maulti_location_gmap_fields', true ); $new = sanitize_meta( '...
0
votes
0answers
31 views

How to use wp_filter_oembed_result?

I have a video iframe it's can be youtube , vimeo etc $iframe = get_field($field, $id); if(empty($iframe)){ return; } preg_match('/...
0
votes
0answers
53 views

Sanitizing array in wordpress options page

I have an array like this [select_post_template_repeater] => Array ( [0] => Array ( [0] => post [template] => ...
0
votes
0answers
32 views

ACF plugin how to correctly escape $_GET variables before dumping them into a query

I found this code in the Advanced Custom Fields documentation and everything works. My concern is a comment on the original post saying the code was open to SQL injection because it doesn't properly '...
0
votes
0answers
43 views

Customizer textarea with script tag won't work in live preview

I have a simple textarea setup in the customizer that I want to use for including a 3rd party form. In order to embed this form I need to paste in 2 script tags into the textarea. This all works ...
0
votes
0answers
22 views

Data Validation & Sanitization for Big HTML Blocks

I'm developing a theme for Envato. Got Soft Reject because of issue typed in the question title. I created a 4 column widget area for my theme's footer. How can I sanitize the $output variable? Thank ...
0
votes
2answers
59 views

Where is the HTML-handler part in the wpdb class?

I'm trying to understand how datas are being handled when saving to the database in the wpdb class. I have searched for where HTML string datas are handled and found a method in the $this->query() ...
0
votes
2answers
108 views

I need to get the control choices to sanitize_callback

Code Currently, I'm working project to automatically generate all my theme customizer options with simple array. 'nav_font_style' => array( 'default_options' => array( 1 ...
0
votes
0answers
65 views

Form Sanitization and Validation

Already asked this on Code Review but no answer there so that's why i'm trying here. I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do ...
0
votes
2answers
83 views

Data not displaying in text field

I have been working on trying to get data to store and display on a CPT field. The code I have is here: function fhaac_subject_box_callback( $post ){ wp_nonce_field( basename(__FILE__ ), '...
0
votes
1answer
104 views

Preserve old values on error in setting API

I am trying to preserve old value of form when it fails the validation defined in sanitize callback of register_setting. But it does not do so, instead it save the default values register_setting('...
0
votes
1answer
30 views

Can we validate data from jquery

Is it ok, to validate some data using jquery? I am working on a plugin which has repeater fields in widgets, so my plan was to convert all repeater field data in json when user clicks on save button. ...
0
votes
2answers
775 views

Best Practice for Validating and Sanitizing Data

I developed a plugin which processes data following user input into a number of forms on the front end. The field types within the forms and the data input varies significantly. To process the data, ...
0
votes
1answer
85 views

Array/List Edit in Backend

I'm kinda new to WordPress Development and even thought the question seems extremely easy for me, I haven't found any solution that works for me. My Plugin uses a option to store a simple array of "...
0
votes
0answers
115 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
1answer
465 views

What function removes apostrophes when making a slug?

I am trying to convert a post title to a slug. I used sanitize_title_with_dashes, thinking that's what WordPress uses. However, if my post title has an apostrophe in it, sanitize_title_with_dashes ...
0
votes
1answer
472 views

Proper Way to Sanitize Meta Input

I have a meta field which gets displaed in the admin panel look like: $field = get_post_meta($postid, 'field_name', true); ?> <input type="text" name="field_name" value="<?php echo (!empty($...
0
votes
1answer
396 views

Sanitization html output itself

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a ...
0
votes
0answers
346 views

Sanitize html, where to sanitize

I have a function that returns an style=".." html attribute. I am not sure how to sanitize. Here is the code: functions.php function zz_style($properties, $values) { $styles_array = array(); ...
0
votes
1answer
298 views

Settings api sanatize callback not being triggered

I'm creating a custom settings page for a custom theme however the callbacks for sanatizing the data in the fields are not being called (I put in xdebug breakpoints in them to check). /** *-----------...
0
votes
1answer
570 views

Auto post with filling templates from external data and update periodical

Hi I want to achieve the following szenario and asking for advice to start off Szenario We have an external mysql-database filled with product informations. This database is delivering data for a ...
0
votes
1answer
113 views

Sanitizing a custom query's clauses

I'm trying to build a custom query much like the one found in WordPress' native get_posts() inside wp-includes/query.php, meaning something along these lines: global $wpdb SELECT * FROM $wpdb->...
-1
votes
1answer
200 views

Is it sensible to worry about sanitizing admin input in plugin custom CSS?

In numerous plugins and themes, developers will provide an option for Admin-level users to enter their own additional CSS (for the sake, obviously, of customizing output). Some plugins and themes also ...