24
votes
Accepted
Sanitize and data validation with apply_filters() function
There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate:
validation
sanitisation
escaping
Sanitisation
...
- 60.6k
14
votes
Is sanitize_title enough to generate post slugs?
sanitize_title() seems to be the only one you need.
In wp-includes/default-filters.php line 211 you will find:
add_filter( 'sanitize_title', 'sanitize_title_with_dashes', 10, 3);
This means that ...
- 1,188
13
votes
Accepted
Does WordPress sanitize arguments to WP_Query?
It's actually a good question. Of course user input cannot be trusted, but also sanitizing the same value twice "just in case" isn't the best solution for a problem.
The only real answer to ...
- 1,090
9
votes
Accepted
Should nonce be sanitized?
Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.
wp_verify_nonce function checks $nonce value like ...
- 8,987
9
votes
wordpress sanitize array?
I needed a recursive sanitation, so here's my solution:
/**
* Recursive sanitation for an array
*
* @param $array
*
* @return mixed
*/
function recursive_sanitize_text_field($array) {
...
- 191
7
votes
Sanitize content from wp_editor
In short: it is in dependence of your context, the data inside your editor.
wp_kses() is really helpful, and you can define your custom allowed HTML tags.
Alternative, you can use the default ...
- 17.1k
7
votes
Accepted
What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?
What Do They Do?
wp_filter_nohtml_kses strips all HTML from a string, that's it. It does it via the wp_kses function and it expects slashed data, here's its implementation:
function ...
- 60.6k
5
votes
Is sanitize_title enough to generate post slugs?
Well, there is already an answer, but I wanted to expand it a bit, so here are my findings:
If we have a look in wp_insert_post() we see, the $post_name is sanitized using wp_sanitize_title() ( see ...
- 3,019
5
votes
Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database
For updating and saving use add_action( 'edit_term', 'save_termmeta_tag' );
- 151
5
votes
Accepted
Sanitizing, Validating and Escaping in WordPress (Plugin)
Now I have familiarized myself with the above principles via the documentation and I think I have understood them now
I don't know which documentation you read, but you should check the Plugin ...
- 39.9k
4
votes
Sanitize content from wp_editor
Try
//save this in the database
$content=sanitize_text_field( htmlentities($_POST['content']) );
//to display, use
html_entity_decode($content);
htmlentities() will convert all characters which ...
- 41
4
votes
How to allow HTML tags into WP Bakery (formerly Visual Composer) `textfield` parameter
You need to change the type from textarea to textarea_raw_html:
https://kb.wpbakery.com/docs/inner-api/vc_map/
Under the section "Available type values" it says:
textarea_raw_html: Text area, ...
- 237
3
votes
Escaping and sanitizing SVGs in metabox textarea
Here is a PHP library that was created for sanitizing SVG files that may be worth looking into. https://github.com/darylldoyle/svg-sanitizer
Here is an example of how this could be used:
// Now do ...
- 731
3
votes
Is sanitize_title enough to generate post slugs?
In addition to websupporter's great answer I found the below:
Depending on your usage it will depend what you need.
sanitize_title() as it says:
accents are removed (accented characters are ...
- 414
3
votes
Sanitize textarea instead of input
Since WordPress 4.7 there is sanitize_textarea_field().
Which does exactly as you want, from the Codex.
Sanitizes a multiline string from user input or from the database.
- 287
3
votes
Accepted
Who is responsible for data sanitization in WordPress development?
Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs.
If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend ...
- 60.6k
3
votes
Accepted
textarea field is getting escaped for some unknown reason
WordPress always adds magic quotes regardless of server settings. This ensures consistency regardless of the environment. Even though magic quotes has been removed or deprecated from PHP, WordPress ...
- 43.9k
3
votes
array_map() for sanitizing $_POST
I think you are in the right path. What you can do to improve is:
Separate the logic in functions to increase readability or do a good commenting what you are doing. E.g.:
...
function ...
- 303
3
votes
Settings API - sanitize_callback is not called and it leads to an incorrect behavior
If I take the value sanitize_callback out of the argument array
completely, everything works as desired, so error-free.
Yes, and that's because you used the wrong callable syntax which then causes ...
- 39.9k
3
votes
Accepted
Cannot get 'sanitize_callback' to work for rest parameters
You're not getting the TESTING because your playlist argument should actually be in the args array like so: (reindented for brevity)
register_rest_route( SoundSystem::$rest_namespace, '/playlist/new', ...
- 39.9k
3
votes
Accepted
wpdb get_results() and prepare when to use prepare?
so if i have a function that gets terms from the database ( not the user ) do I need to use prepare first ( before get_results() ), or some sort of data sanitizing?
Yes, but you should be using ...
- 60.6k
3
votes
Accepted
esc_url, esc_url_raw or sanitize_url?
This might be a more useful demonstration:
<a href="<?php echo esc_url( $url ); ?>>I'm printing a URL to the frontend</a>
$url = sanitize_url( $_GET['user_inputted_data'] );
...
- 60.6k
3
votes
Accepted
What is the proper way to sanitize $_POST and $_GET vars?
If I understand correctly, WordPress automatically applies a wp_slash() on the global $_POST variable: should this means that for any $_POST variable, prior to saving to the DB, we should first ...
- 60.6k
2
votes
How to display data from custom table in wordpress database?
Please try this code for display all the records from database in wordpress. For this firstly need to create a file.php inside your selected wordpress folder and then use this file as a template. And ...
2
votes
Sanitizing post content for use in an email
I'm not sure why the accepted answer here was accepted since it is not actually going to work.
The OP was how to sanitize the email content. sanitize_email() sanitizes an email address. Sure, it ...
- 5,071
2
votes
Accepted
Do Not Understand → Rule No. 4: Making Data Safe Is About Context
I'm the original author of that article, hopefully I can elaborate on my point ("Rule 4").
The 'data' in this case is the value entered by the user:
$raw = '<textarea name="my-textarea"></...
- 32.6k
2
votes
Escape hexadecimals/rgba values
Just finished now the sanitize callback for RGBA colors.and tested in my theme and working perfect, and its taking RGBA values
please find the code
function awstheme_sanitize_rgba( $color ) {
...
- 59
2
votes
how to sanitize checkbox input?
Be sure to set the value in your markup. You should have.
<input type="checkbox" name="changeposition" value="yes" />
Then, I'd suggest using sanitize_key() to sanitize.
Keys are used as ...
- 851
2
votes
Accepted
How to use esc_attr__() function properly to translate a variable that contains string?
If you have static text with dynamic content then you can use.
printf( esc_attr___('static text goes here with %s', 'text-domain' ), $title );
If you have only $title then no need to translate it.
...
- 1,068
2
votes
Default WordPress taxonomy (Tag) - How to add a custom field to form and save it to the database
Actually I also wanted to use it now. Basically this is the only place in the internet to actually work for Tags.
I have found some troubles with it, managed to edit it and it works for me now:
Here ...
- 21
Only top scored, non community-wiki answers of a minimum length are eligible