From the reference/description of sanitize_text_field()
:
Checks for invalid UTF-8,
Converts single < characters to entities
Strips all tags
Removes line breaks, tabs, and extra whitespace
Strips octets
So a simple fix is, use sanitize_textarea_field()
:
The function is like sanitize_text_field(), but preserves new lines (\n) and other whitespace, which are legitimate input in textarea elements.
// In save_custom_metaboxes()
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] ); // use this one
//$itinerary = sanitize_text_field( $_POST['txtItinerary'] ); // and not this
Additional Notes
Also, you should use esc_textarea()
(although the output may not contain HTML tags):
<textarea class="trek_inputs required" name="txtItinerary"...><?php echo // wrapped for clarity
esc_textarea( $content ); ?></textarea>
And you'd also want to remove line break after each <br />
:
$itinerary = sanitize_textarea_field( $_POST['txtItinerary'] );
$itinerary = nl2br( $itinerary );
// Removes line break after each <br />, if any.
$itinerary = preg_replace( "#<br />(\r\n|\n|\r)#", '<br />', $itinerary );