Questions tagged [sanitization]

Sanitization means clearing data (often: user input) of unwanted input. This is done to prevent errors or security problems like injection of malicious code into the database. WP offers over a large number of sanitization functions to make data safe for further usage.

Filter by
Sorted by
Tagged with
20
votes
4answers
18k views

Is sanitize_title enough to generate post slugs?

I want to generate slug for some strings without going through WordPress slug generation flow. Therefore, I want to know which functions it calls to get a neat slug. I tried sanitize_title() but it ...
17
votes
2answers
867 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
15
votes
2answers
6k views

Data sanitization: Best Practices with code examples

I am trying to understand data sanitization (not data validation) to help me write secure themes for WordPress. I have searched the Internet trying to find a comprehnsive guide for theme developers ...
13
votes
3answers
3k views

Should I sanitize an email address before passing it to the is_email() function?

I'm using is_email() to check if a user-provided email address is valid. For example: $email = $_POST['email']; if ( is_email( $email ) ) // Do something. To the best of my knowledge, nothing in ...
13
votes
1answer
2k views

How safe / sanitized is wp_insert_posts()?

Looking at the Codex for wp_insert_post() it states that this function "...sanitizes variables, does some checks, fills in missing variables like date/time, etc. " (EDIT: I updated the Codex entry to ...
11
votes
2answers
6k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., &...
11
votes
1answer
14k views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
9
votes
1answer
6k views

How to safely sanitize a textarea which takes full HTML input

I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags ...
8
votes
4answers
11k views

wordpress sanitize array?

I have a custom post form that sends data to a page which uses wp_insert_post to create a post. I can easily sanitize most data, but I have some troubles with my tags, I retrieve in an array: $tags = ...
8
votes
4answers
5k views

Sanitize content from wp_editor

I built a custom post type where we can find a standard textarea/tinymce generated by wp_editor() and I'm facing an issue for the saving part. If I save the content with the following code : ...
8
votes
1answer
4k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
7
votes
1answer
626 views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '…' ) );...
7
votes
1answer
15k views

Custom page with variables in url. Nice url with add_rewrite_rule

Using WP3.1 I Have a custom page with a WP_Query and the query gets dynamic variables from the url. And i want safe variables and clean urls. Example: carpage/?carmodel=honda&location=...
7
votes
1answer
6k views

What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?

Taken from the articles referenced below: wp_strip_all_tags() "Properly strip all HTML tags including script and style." wp_filter_nohtml_kses() "Strips all of the HTML in the content." Ref: ...
7
votes
3answers
2k views

Reason for Lowercase usernames

I can see validate_user() calls sanitize_user() with strict argument as true, which means uppercase letters are not allowed too. In source code, I found this comment // If strict, reduce to ASCII ...
7
votes
2answers
4k views

What is the best way to sanitize data?

I've read several topics about this and different people have different views on the best practice. In terms of WordPress, how do I write data to the database the safest way? This is one insert I'm ...
7
votes
1answer
1k views

Which KSES should be used and when?

The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes." On the other hand, wp_kses_data is passed data that's "expected to not be ...
6
votes
3answers
6k views

Sanitizing integer input for update_post_meta

When updating a post meta where the input will be always an integer, should I use (int) or is there a WordPress function for that (eg. sanitize_text_field)? For example: if(isset($_POST['category_id'...
6
votes
5answers
4k views

Sanitize User Entered CSS

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like ...
6
votes
2answers
4k views

Settings API - sanitizing urls, email addresses and text

I am asking for advice on best practices on how to write this code. Currently I have simple theme options with text fields, outputting the info in my template. I am currently using this code for the ...
6
votes
1answer
2k views

What is the difference between esc_html and wp_filter_nohtml_kses?

What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
6
votes
2answers
2k views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
6
votes
1answer
215 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
5
votes
2answers
12k views

Escaping quotes from shortcode attributes

I have been trying to figure out how to escape quotes (single and double) from shortcode attributes. Basically the content is written by the user and therefore can potentially include " and ' quotes. ...
5
votes
1answer
3k views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( $_POST[$...
5
votes
1answer
791 views

Sanitation needed for WP_Query or get_posts calls?

Just wanted to get a straight answer on this: when submitting query_vars to a call to get_posts or WP_Query, is sanitation needed or does WordPress already take care of that?
5
votes
1answer
2k views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
5
votes
1answer
3k views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
5
votes
4answers
10k views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
5
votes
1answer
123 views

Can I create customizer setting that can handle plugin shortcode?

Can I create a customizer setting which will handle a shortcode from a plugin? Do I violate and rules or guidelines in WordPress theme development? If it's possible what is the best way to sanitize ...
4
votes
2answers
7k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
4
votes
1answer
2k views

Make shortcode work with nested double quotes

I have following shortcode: function infobox_shortcode( $atts, $content = null ) { extract( shortcode_atts( array( 'src' => '', 'title' => '', 'text' => '', ), $...
4
votes
1answer
988 views

esc_url removes white space. Can I change that to using '-'?

I'm using esc_url to sanitize my url. The only problem is that "my link" becomes "mylink". I wouldreally like it to become "my-link". Is there a way to change this?
4
votes
1answer
249 views

Shortcode putting html such as <img>

$atts = shortcode_atts( array( 'path' => 'https://s.w.org/about/images/logos/wordpress-logo-simplified-rgb.png' ), $atts); The above is a part of the shortcode. In Wordpress text ...
3
votes
1answer
3k views

Default Wordpress settings API data sanitization

It looks to me that when saving data to the database via the settings API Wordpress sanitizes data by default. By that I mean that if I look at the raw settings options in the database they have (at ...
3
votes
3answers
2k views

How do I sanitize a javascript text?

I have a textarea that will receive a js snippet(Google Analytics). Is there a way to sanitize that? Since I cannot use functions like wp_filter_nohtml_kse(), what should I use?
3
votes
3answers
993 views

WP doesn't show Array Custom Fields?

I'm wondering why WordPress doesn't list PHP array() and any serialized data in Custom Fields in Admin Panel (for Pages, Posts etc.)? Only Custom Fields containing strings and numbers show up and can ...
3
votes
1answer
2k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
3
votes
1answer
1k views

Importing JSON feed should the content be sanitized?

I've been doing a lot of research and had several discussions in chat about learning to take a JSON feed and add the content to a post in WordPress. In the past I would create a page template and ...
3
votes
1answer
2k views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
3
votes
1answer
507 views

Sanitatizing when using the posts_where hook

I am altering the WordPress query, using the posts_where hook, when a (custom) query variable is set as follows: add_filter('posts_where', 'my_posts_where' ); function my_posts_where( $where ){ ...
2
votes
2answers
3k views

How to properly sanitize strings without $wpdb->prepare?

I'm working on an advanced search (which uses custom sql queries), and the query string is formed using variables. For example, if the person checks some options, only those conditions get added to ...
2
votes
4answers
61k views

How to display data from custom table in wordpress database?

I want to retrieve data from custom table, that I've made inside the wordpress database and display it in a wordpress page , like posts Thanks in advance
2
votes
1answer
762 views

Should nonce be sanitized?

The general guideline is that we should sanitize all user input before using them. Now my questions is whether this applies to nonce or not. Which one is correct? wp_verify_nonce( ...
2
votes
2answers
484 views

Sanitizing `wp_editor();` Values for Database, Edit, and Display

I'm using custom instances of wp_editor(); to allow rich text editing of Post Meta associated with a Post Object. I'd like to perform much of the same sanitization that occurs with post_content for ...
2
votes
1answer
778 views

Escape hexadecimals/rgba values

I know that sanitize_hex_color exists for sanitizing hexadecimal values going into the database (and only exists in the Customizer), but what's the best function to escape those same values. Should I ...
2
votes
2answers
332 views

array_map() for sanitizing $_POST

I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I am using the array_map() function to iterate over the array with sanitize_text_fields()...
2
votes
2answers
6k views

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

While writing a custom element for WC Bakery (formerly Visual Composer) I've discovered that the HTML tags are being stripped from the textfield parameter type. It's sanitizing the textfield value by ...
2
votes
1answer
1k views

How does Wordpress store data?

I have looked inside Wordpress database. Example: In wp_options table, option_name column, active_plugins row, its option_value is a:7:{i:0;s:27:"clean-html/cleanup-html.php";i:1;s:59:"force-...
2
votes
1answer
851 views

I'm confused about URL sanitization in meta boxes

I'm making a meta box for a custom post and this meta box will contain a href value. I don't need any validation as this is a valid href value but I would like to do this in a way that's secure. I ...