Skip to main content
Share Your Experience: Take the 2024 Developer Survey
24 votes
Accepted

Sanitize and data validation with apply_filters() function

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation ...
Tom J Nowell's user avatar
  • 59.4k
12 votes
Accepted

Does WordPress sanitize arguments to WP_Query?

It's actually a good question. Of course user input cannot be trusted, but also sanitizing the same value twice "just in case" isn't the best solution for a problem. The only real answer to ...
Álvaro Franz's user avatar
11 votes

Is sanitize_title enough to generate post slugs?

sanitize_title() seems to be the only one you need. In wp-includes/default-filters.php line 211 you will find: add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3); This means that ...
Jules's user avatar
  • 1,138
9 votes

wordpress sanitize array?

I needed a recursive sanitation, so here's my solution: /** * Recursive sanitation for an array * * @param $array * * @return mixed */ function recursive_sanitize_text_field($array) { ...
Broshi's user avatar
  • 191
8 votes
Accepted

Should nonce be sanitized?

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison. wp_verify_nonce function checks $nonce value like ...
Fayaz's user avatar
  • 8,917
7 votes

Sanitize content from wp_editor

In short: it is in dependence of your context, the data inside your editor. wp_kses() is really helpful, and you can define your custom allowed HTML tags. Alternative, you can use the default ...
bueltge's user avatar
  • 17.1k
6 votes

Customizer sanitize_callback for input type number

Add a setting, specifying the sanitize_callback: $wp_customize->add_setting( 'my_input', array( 'default' => '100.00', 'sanitize_callback' => 'sanitize_float', ) )...
mistertaylor's user avatar
6 votes
Accepted

What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?

What Do They Do? wp_filter_nohtml_kses strips all HTML from a string, that's it. It does it via the wp_kses function and it expects slashed data, here's its implementation: function ...
Tom J Nowell's user avatar
  • 59.4k
5 votes

Is sanitize_title enough to generate post slugs?

Well, there is already an answer, but I wanted to expand it a bit, so here are my findings: If we have a look in wp_insert_post() we see, the $post_name is sanitized using wp_sanitize_title() ( see ...
websupporter's user avatar
  • 2,979
5 votes

Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database

For updating and saving use add_action( 'edit_term', 'save_termmeta_tag' );
Ben's user avatar
  • 151
5 votes
Accepted

Sanitizing, Validating and Escaping in WordPress (Plugin)

Now I have familiarized myself with the above principles via the documentation and I think I have understood them now I don't know which documentation you read, but you should check the Plugin ...
Sally CJ's user avatar
  • 39.3k
4 votes

Echo JavaScript Safely

What you're asking for is impossible, there is no such thing as a safe javascript entry box. Any attempt to strip out HTML would probably break the javascript too, e.g. document.write('<b>Hello!&...
Tom J Nowell's user avatar
  • 59.4k
4 votes

Sanitize content from wp_editor

Try //save this in the database $content=sanitize_text_field( htmlentities($_POST['content']) ); //to display, use html_entity_decode($content); htmlentities() will convert all characters which ...
Melch Wang's user avatar
4 votes

Is default functions like update_post_meta safe to use user inputs?

After upvoting @pieter's answer.... In recent time I came to the realization that it is much better to handle "bad" data gracefully when it is used (usually it means escaping, but also validation) ...
Mark Kaplun's user avatar
  • 23.4k
4 votes

How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter

You need to change the type from textarea to textarea_raw_html: https://kb.wpbakery.com/docs/inner-api/vc_map/ Under the section "Available type values" it says: textarea_raw_html: Text area, ...
rtpHarry's user avatar
  • 237
3 votes
Accepted

Who is responsible for data sanitization in WordPress development?

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs. If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend ...
Tom J Nowell's user avatar
  • 59.4k
3 votes

Is default functions like update_post_meta safe to use user inputs?

Never leave anything to chance, always sanitize, escape and validate all data coming from forms and super globals like $_GET and $_POST according to your requirements and the data type you are ...
Pieter Goosen's user avatar
3 votes

Escaping and sanitizing SVGs in metabox textarea

Here is a PHP library that was created for sanitizing SVG files that may be worth looking into. https://github.com/darylldoyle/svg-sanitizer Here is an example of how this could be used: // Now do ...
Marc's user avatar
  • 721
3 votes

Is sanitize_title enough to generate post slugs?

In addition to websupporter's great answer I found the below: Depending on your usage it will depend what you need. sanitize_title() as it says: accents are removed (accented characters are ...
Brett's user avatar
  • 414
3 votes

Sanitizing integer input for update_post_meta

&safe_id = intval( $_POST['category_id'] ); if ( ! $safe_id ) { $safe_id = ''; } update_post_meta( $post->ID, 'category_id', $safe_id ); The intval() function casts user input as an integer,...
Annapurna's user avatar
  • 324
3 votes

Sanitize textarea instead of input

Since WordPress 4.7 there is sanitize_textarea_field(). Which does exactly as you want, from the Codex. Sanitizes a multiline string from user input or from the database.
Mark's user avatar
  • 277
3 votes
Accepted

textarea field is getting escaped for some unknown reason

WordPress always adds magic quotes regardless of server settings. This ensures consistency regardless of the environment. Even though magic quotes has been removed or deprecated from PHP, WordPress ...
Jacob Peattie's user avatar
3 votes

array_map() for sanitizing $_POST

I think you are in the right path. What you can do to improve is: Separate the logic in functions to increase readability or do a good commenting what you are doing. E.g.: ... function ...
Lucas Vendramini's user avatar
3 votes

Settings API - sanitize_callback is not called and it leads to an incorrect behavior

If I take the value sanitize_callback out of the argument array completely, everything works as desired, so error-free. Yes, and that's because you used the wrong callable syntax which then causes ...
Sally CJ's user avatar
  • 39.3k
3 votes
Accepted

Cannot get 'sanitize_callback' to work for rest parameters

You're not getting the TESTING because your playlist argument should actually be in the args array like so: (reindented for brevity) register_rest_route( SoundSystem::$rest_namespace, '/playlist/new', ...
Sally CJ's user avatar
  • 39.3k
3 votes
Accepted

What is the proper way to sanitize $_POST and $_GET vars?

If I understand correctly, WordPress automatically applies a wp_slash() on the global $_POST variable: should this means that for any $_POST variable, prior to saving to the DB, we should first ...
Tom J Nowell's user avatar
  • 59.4k
2 votes

How to display data from custom table in wordpress database?

Please try this code for display all the records from database in wordpress. For this firstly need to create a file.php inside your selected wordpress folder and then use this file as a template. And ...
ABHISHEK GUPTA's user avatar
2 votes

Sanitizing post content for use in an email

I'm not sure why the accepted answer here was accepted since it is not actually going to work. The OP was how to sanitize the email content. sanitize_email() sanitizes an email address. Sure, it ...
butlerblog's user avatar
  • 4,996
2 votes

how to sanitize checkbox input?

Be sure to set the value in your markup. You should have. <input type="checkbox" name="changeposition" value="yes" /> Then, I'd suggest using sanitize_key() to sanitize. Keys are used as ...
jaswrks's user avatar
  • 851

Only top scored, non community-wiki answers of a minimum length are eligible