19

esc_html() is more or less lossless — it just turns HTML markup into encoded visible text, so that it's not rendered as markup by browser. Semantically it's escape, so it's meant to be used to make output to page safe. sanitize_text_field() however actually removes all HTML markup, as well as extra whitespace. It leaves nothing but plain text. ...


18

WordPress and PHP core The is_email() function Source is a typical WordPress implementation and does not work completely with what the RFC 6531 allows. One reason might be, that the default PHP FILTER_VALIDATE_EMAIL constant for filter_var() isn't much better at validating something according to the The Internet Engineering Task Force (IETF®) guidelines. ...


16

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation Sanitisation makes things clean and well formed This cleans up the data, e.g. trimming trailing spaces, removing letters in a number field, making an all lowercase ...


15

There are two concepts here: validation - making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation - making the date safe for its use in the current context (e.g. escaping SQL queries, or escaping HTML on output). Validation is, almost universally, ...


15

There is already a huge list built for you, which can be returned by wp_kses_allowed_html() based on context, and filtered via the wp_kses_allowed_html filter, also contextually. Creating that list should not be hard. However, "the whole range of HTML tags that might appear in an HTML email" should be pretty close to the range allowed for an ordinary post ...


12

The wp_strip_all_tags() function will remove all HTML, including the content of script and style tags. The PHP strip_tags() function largely does the same thing, except it won't eliminate the content of script and style tags. WP's wp_strip_all_tags() function uses this after eliminating the scripts and styles manually. The wp_filter_nohtml_kses() function ...


10

WordPress will not do any data sanitization for you. It does do sanitization/validation of the default options. You have to pass in the third argument of register_setting and either role your own validation callback or or use one of the builtins. If your options is only going to contain a string, you could do something like this, for instance. <?php ...


7

Here is an example code that will get the data and then display it: global $wpdb; // this adds the prefix which is set by the user upon instillation of wordpress $table_name = $wpdb->prefix . "your_table_name"; // this will get the data from your table $retrieve_data = $wpdb->get_results( "SELECT * FROM $table_name" ); ?> <ul> foreach ($...


7

It turns out WordPress shortcode system uses function shortcode_parse_atts($text); to parse a shortcode entry to retrive attributes' names and values and store them in pairs in the array $atts, which is then passed to the shortcode function. So in your case adding escaping actions in the shortcode function like this: $aps_person_description = esc_html($atts[...


7

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn't. The sanitize_email() will ...


6

I can't use $wpdb->prepare, since I want to be able to add variables to my query string that look something like: $var = "AND pm.meta_value = '%$_POST['val']%'"; To get a literal % to pass through $wpdb->prepare just double it. You don't need to be avoiding $wpdb->prepare. Proof of concept: var_dump($wpdb->prepare('SELECT * FROM {$wpdb->...


6

Use mysqli_real_escape_string(). The core uses still the deprecated mysql_real_escape_string() or add_slashes() in wpdb::_real_escape() … /** * Real escape, using mysql_real_escape_string() or addslashes() * * @see mysql_real_escape_string() * @see addslashes() * @since 2.8.0 * @access private * * @param string $string to escape * @return ...


6

You can use sanitize_title() function: $string = "This is title string"; // return "this-is-title-string" $slug = sanitize_title( $string ); You can also filter the result of sanitize_title() function using sanitize_title filter: add_filter( 'sanitize_title' , 'sanitize_filter_callback', 10, 3 ); function sanitize_filter_callback( $title, $raw_title, $...


6

When accepting user data inputs, I think that data validation must be performed if possible, not only sanitization. For example, you could expect a number, a bool value, a text string (even when the input is a selectbox it can have a string value), etc. You can santize for that data types; then you can go further and validate the data against expected values:...


6

I'm not sure if this is a bug, but it need further investigation. I've run a few quick tests on the name field in a tax_query, and whenever a term name has got a special character or have more than one word, the tax_query is excluded from the SQL query TEST 1 I have use two terms here, your term Ski-in/Ski-out and one of the terms on my test site Uit die ...


5

This video by Mark Jaquith cleared it all up for me. http://wordpress.tv/2011/01/29/mark-jaquith-theme-plugin-security/


5

One simple way to do it would be to have the user enter just his or her Google Analytics Property ID, instead of having them input the entire JavaScript code. Then you generate the snippet yourself, using their Property ID. According to this Google help page, here is the current Analytics tracking code: <script type="text/javascript"> var _gaq = ...


5

For integers KSES has no special function. Use (int) or intval() or absint() See more: Data Validation - Integers


5

Looking at the is_email() functionality on trac, it looks like you don't need to sanatizie as it's just string testing. I would even go so far as to say that if this function returns true, you wouldn't need to sanitize it before sending it into the database.


5

No need to reinvent the wheel - put your editor support back and tweak the settings: function wpse_199918_wp_editor_settings( $settings, $editor_id ) { if ( $editor_id === 'content' && get_current_screen()->post_type === 'custom_post_type' ) { $settings['tinymce'] = false; $settings['quicktags'] = false; $settings['...


4

sanitize_title() seems to be the only one you need. In wp-includes/default-filters.php line 211 you will find: add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3); This means that calling sanitize_title() will first remove all the special characters, then apply the sanitize_title filter, thus calling sanitize_title_with_dashes() As @...


4

Well, there is already an answer, but I wanted to expand it a bit, so here are my findings: If we have a look in wp_insert_post() we see, the $post_name is sanitized using wp_sanitize_title() ( see wp-includes/post.php) In the function sanitize_title() we have a filter sanitize_title. This is interesting, since in the default filters ...


4

WordPress doesn't provide any specific data validation functions for SUPERGLOBALS. I use the PHP filter_input function then escape it as I would any untrusted variable. $url = filter_input( INPUT_GET, 'some_query_string', FILTER_VALIDATE_URL ); echo '<a href="'. esc_url( $url ). '">Click Me</a>'; The PHP filter input accepts: ...


4

There is no filter to change that behavior, you would have to replace the entire metabox. On the other hand: I think there is no really simple way to show and to save those arrays. Example for a fictive meta key 'foo': array ( 0 => 2, 'hello' => array ( 0 => 2, 'hello' => 'world' ) ) Creating a default interface ...


4

Add a setting, specifying the sanitize_callback: $wp_customize->add_setting( 'my_input', array( 'default' => '100.00', 'sanitize_callback' => 'sanitize_float', ) ); Add the control: $wp_customize->add_control( 'my_input', array( 'label' => 'Please enter a number:', 'section' => '...


4

After upvoting @pieter's answer.... In recent time I came to the realization that it is much better to handle "bad" data gracefully when it is used (usually it means escaping, but also validation) than at input time. Data corruption can happen not only because of some rouge process "shitting" over your data, but also when the enviroment has changed and the ...


4

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison. wp_verify_nonce function checks $nonce value like this: if ( hash_equals( $expected, $nonce ) ) { return 1; } For this you don't need sanitizing. So the following is fine: wp_verify_nonce( $_GET['...


4

In short: it is in dependence of your context, the data inside your editor. wp_kses() is really helpful and you can define your custom allowed HTML. Alternative you can use the default functions, like wp_kses_post or wp_kses_data. This functions are helpful in ensuring that HTML received from the user only contains white-listed elements. See https://codex....


3

If you want to use the above sanitize_file_name filter, you could try this: function make_filename_hash($filename) { if( isset($_REQUEST['post_id']) ) { $post_id = (int)$_REQUEST['post_id']; }else{ $post_id=0; } $info = pathinfo($filename); $ext = empty($info['extension']) ? '' : '.' . $info['extension']; $name = ...


Only top voted, non community-wiki answers of a minimum length are eligible