26

You are almost there. The function you need is sanitize_title_with_dashes( $title )


18

WordPress and PHP core The is_email() function Source is a typical WordPress implementation and does not work completely with what the RFC 6531 allows. One reason might be, that the default PHP FILTER_VALIDATE_EMAIL constant for filter_var() isn't much better at validating something according to the The Internet Engineering Task Force (IETF®) guidelines. ...


17

Here's a way to do it with PHP's array map function: // Good idea to make sure things are set before using them $tags = isset( $_POST['tags'] ) ? (array) $_POST['tags'] : array(); // Any of the WordPress data sanitization functions can be used here $tags = array_map( 'esc_attr', $tags );


16

The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late). So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data in the template.


16

esc_html() is more or less lossless — it just turns HTML markup into encoded visible text, so that it's not rendered as markup by browser. Semantically it's escape, so it's meant to be used to make output to page safe. sanitize_text_field() however actually removes all HTML markup, as well as extra whitespace. It leaves nothing but plain text. ...


16

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation Sanitisation makes things clean and well formed This cleans up the data, e.g. trimming trailing spaces, removing letters in a number field, making an all lowercase ...


15

There are two concepts here: validation - making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation - making the date safe for its use in the current context (e.g. escaping SQL queries, or escaping HTML on output). Validation is, almost universally, ...


14

The kses functions should be used when you want to allow some subset of html to be in the result. For example, comments allow some HTML in them for bold, italic, links, and such. The esc_html function should be used to escape html completely. No HTML will go through it without being converted to something that will be interpreted as non-HTML by a browser.


12

This codex page explains it pretty well I think. The most important and commonly used function is probably esc_attr. Take this example: <a href="<?php print $author_url; ?>" title="<?php print $author_name; ?>"> <?php print $author_name; ?> </a> If $author_name contains a " character you get your attribute closed, and if ...


12

There is already a huge list built for you, which can be returned by wp_kses_allowed_html() based on context, and filtered via the wp_kses_allowed_html filter, also contextually. Creating that list should not be hard. However, "the whole range of HTML tags that might appear in an HTML email" should be pretty close to the range allowed for an ordinary post ...


11

You don't have to do anything. On WP load: 'init' hook -> kses_init() -> kses_init_filters() Later: wp_insert_post() -> sanitize_post() -> sanitize_post_field() -> 'content_save_pre' -> wp_filter_post_kses() Similarly for post titles, comment text etc. Conclusion: wp_insert_post() is very sanitized. :)


10

WordPress will not do any data sanitization for you. It does do sanitization/validation of the default options. You have to pass in the third argument of register_setting and either role your own validation callback or or use one of the builtins. If your options is only going to contain a string, you could do something like this, for instance. <?php ...


10

The wp_strip_all_tags() function will remove all HTML, including the content of script and style tags. The PHP strip_tags() function largely does the same thing, except it won't eliminate the content of script and style tags. WP's wp_strip_all_tags() function uses this after eliminating the scripts and styles manually. The wp_filter_nohtml_kses() function ...


7

No. Parameters given to the WP_Query object only need to be escaped for the database query - this is handled by WordPress.


6

Here is an example code that will get the data and then display it: global $wpdb; // this adds the prefix which is set by the user upon instillation of wordpress $table_name = $wpdb->prefix . "your_table_name"; // this will get the data from your table $retrieve_data = $wpdb->get_results( "SELECT * FROM $table_name" ); ?> <ul> foreach ($...


6

Uppercase characters are not blocked in usernames on single site setups. Uppercase characters ARE blocked in usernames on multisite setups. The wpmu_validate_user_signup function forces lowercase a-z and numbers 0-9 only.


6

It turns out WordPress shortcode system uses function shortcode_parse_atts($text); to parse a shortcode entry to retrive attributes' names and values and store them in pairs in the array $atts, which is then passed to the shortcode function. So in your case adding escaping actions in the shortcode function like this: $aps_person_description = esc_html($atts[...


6

I can't use $wpdb->prepare, since I want to be able to add variables to my query string that look something like: $var = "AND pm.meta_value = '%$_POST['val']%'"; To get a literal % to pass through $wpdb->prepare just double it. You don't need to be avoiding $wpdb->prepare. Proof of concept: var_dump($wpdb->prepare('SELECT * FROM {$wpdb->...


6

You can use sanitize_title() function: $string = "This is title string"; // return "this-is-title-string" $slug = sanitize_title( $string ); You can also filter the result of sanitize_title() function using sanitize_title filter: add_filter( 'sanitize_title' , 'sanitize_filter_callback', 10, 3 ); function sanitize_filter_callback( $title, $raw_title, $...


6

I'm not sure if this is a bug, but it need further investigation. I've run a few quick tests on the name field in a tax_query, and whenever a term name has got a special character or have more than one word, the tax_query is excluded from the SQL query TEST 1 I have use two terms here, your term Ski-in/Ski-out and one of the terms on my test site Uit die ...


5

This video by Mark Jaquith cleared it all up for me. http://wordpress.tv/2011/01/29/mark-jaquith-theme-plugin-security/


5

Use mysqli_real_escape_string(). The core uses still the deprecated mysql_real_escape_string() or add_slashes() in wpdb::_real_escape() … /** * Real escape, using mysql_real_escape_string() or addslashes() * * @see mysql_real_escape_string() * @see addslashes() * @since 2.8.0 * @access private * * @param string $string to escape * @return ...


5

One simple way to do it would be to have the user enter just his or her Google Analytics Property ID, instead of having them input the entire JavaScript code. Then you generate the snippet yourself, using their Property ID. According to this Google help page, here is the current Analytics tracking code: <script type="text/javascript"> var _gaq = ...


5

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn't. The sanitize_email() will ...


5

Looking at the is_email() functionality on trac, it looks like you don't need to sanatizie as it's just string testing. I would even go so far as to say that if this function returns true, you wouldn't need to sanitize it before sending it into the database.


5

When accepting user data inputs, I think that data validation must be performed if possible, not only sanitization. For example, you could expect a number, a bool value, a text string (even when the input is a selectbox it can have a string value), etc. You can santize for that data types; then you can go further and validate the data against expected values:...


5

No need to reinvent the wheel - put your editor support back and tweak the settings: function wpse_199918_wp_editor_settings( $settings, $editor_id ) { if ( $editor_id === 'content' && get_current_screen()->post_type === 'custom_post_type' ) { $settings['tinymce'] = false; $settings['quicktags'] = false; $settings['...


4

Technical difference is kinda obvious. PHP one is single function, using logic in PHP code. WP one is one of family of functions, based on third party KSES library. Is there practical difference between these two specific functions? I think the important point is that strip_tags() was made for utility, while KSES was made for security. So, while results ...


4

Contrary to what you have been looking at, esc_html does not strip all the HTML, it escapes it, meaning it encodes it into safe HTML entities that do not break HTML tags. wp_filter_nohtml_kses strips all the HTML. When in doubt always consult the source code. It is accessible online. esc_attr is short and sweet, uses _wp_specialchars, defined in wp-...


Only top voted, non community-wiki answers of a minimum length are eligible