35

WordPress 5.3 introduces a considerably simpler way to achieve this. By registering theme support for HTML 5 for script and style, the type="" attribute will be omitted: add_action( 'after_setup_theme', function() { add_theme_support( 'html5', [ 'script', 'style' ] ); } );


21

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation Sanitisation makes things clean and well formed This cleans up the data, e.g. trimming trailing spaces, removing letters in a number field, making an all lowercase ...


17

You can remove the type='*' attributes and values from wp_enqueue'ed scripts and styles, using respective *_loader_tag hooks. The following worked for me: add_action( 'wp_enqueue_scripts', 'myplugin_enqueue' ); function myplugin_enqueue() { // wp_register_script(... // wp_enqueue_script(... } add_filter('style_loader_tag', '...


14

Answering my own question: As suggested by WebElaine I created a completely new block to fix the problem. To make this task easier, I used create-guten-block by Ahmad Awais, which is pretty easy to set up. In init.php I made sure to enqueue my JavaScript and extra CSS for the frontend. This should be straight forward. I recommend reading the Learning ...


12

Use the native php function Filter Validator if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) { die('Not a valid URL'); }


8

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn't. The sanitize_email() will ...


7

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


6

I know this is an old post, but for anyone visiting it's also worth considering the WP functions esc_url() and esc_url_raw(), the latter being safe for databases entries etc, as it does not encode entities. esc_url() does encode entities and so is good for display to users. In the source you can see that esc_url() checks for a whitelist of allowed ...


6

Approach 1, disable save button What you can do, is to prevent the user from saving the form if the required fields are not filled. This can be simply done via javascript. function require_fields_script(){ echo " <script type='text/javascript'> (function($){ $('#submit').on('click',function(e){ ...


6

There is no such maxLength option in the WP REST API. You can pass a validate_callback though. Example: <?php add_action( 'rest_api_init', function () { register_rest_route( 'myplugin/v1', '/author/(?P<id>\d+)', array( 'methods' => 'GET', 'callback' => 'my_awesome_func', 'args' => array( 'id' => ...


6

WordPress doesn't add the frameborder attribute. YouTube does. It's part of their embed code. If you absolutely must remove it you can use the embed_oembed_html filter to modify the returned HTML: function wpse_308247_remove_frameborder( $html, $url ) { // If the URL to be embedded is from YouTube. if ( strpos( $url, 'youtube.com' ) !== false ) { ...


5

One simple way to do it would be to have the user enter just his or her Google Analytics Property ID, instead of having them input the entire JavaScript code. Then you generate the snippet yourself, using their Property ID. According to this Google help page, here is the current Analytics tracking code: <script type="text/javascript"> var _gaq = ...


5

I found wp_http_validate_url quite convenient to check if a string in valid URL or not while working on my project. Take a reference from here: https://developer.wordpress.org/reference/functions/wp_http_validate_url/ For example: $val = 'http://somevalidurl.com'; if ( wp_http_validate_url( $val ) ) { // It's valid URL; } else { // It's NOT ...


5

The class-oembed.php file reveals some of the available filters regarding the oEmbeds. We can use the oembed_result or oembed_dataparse filters to modify the HTML fetched from Vimeo before it's cached in the post meta. Here's an example for the latter: add_filter( 'oembed_dataparse', function( $return, $data, $url ) { // Target only Vimeo: if( ...


4

Don't rely entirely on JavaScript validations. Use below hook for Server side validation. function check_if_post_content_set( $maybe_empty, $postarr ) { // Check if post is already created. IMPORTANT if($postarr['ID'] && (int)$postarr['ID'] > 0){ if( !$postarr['post_content'] OR $postarr['post_content'] == '' OR $postarr['post_content'] == ...


3

I register custom post type on init action and the validate which I'm writing about is set to register_setting inside admin_init action. This is the key to your issue. You're registering the custom post type, and presumably you're setting up the rewrite rules in that registration. When you call flush_rewrite_rules(), the rules are rebuilt right then, at ...


3

All of the code in your question can be replaced with: require_once( ABSPATH . 'wp-admin/includes/image.php' ); require_once( ABSPATH . 'wp-admin/includes/file.php' ); require_once( ABSPATH . 'wp-admin/includes/media.php' ); if ( $_FILES ) { foreach ($_FILES as $file => $array) { $image_post_id = media_handler_upload( $file ); if ( is_wp_error( ...


3

Because on the minimum version required it isn't always available since the SPL can be disabled on PHP 5.2 and below. The majority of installs running WordPress have it, but not all, and it's the same reason autoloaders and Iterators aren't used. Moving to v5.3 as a minimum PHP would fix this however as the SPL cannot be disabled in 5.3+, but until that ...


3

According to the documentation, is_email() is used to validate an email and either returns the email if it is valid or false if it isn't. So are using it correctly. The only thing I can see in your code is that if the email is not valid, you are settings the data to a boolean value of FALSE. $instance['email'] = is_email($new_instance['email']); //with a ...


3

You can escape the HTML, so instead of echo $item['link']; you would write: echo esc_html($item['link']); // This is a WP function //or echo htmlspecialchars($item['link']); //PHP equivalent Also important to note your code is depreciated, fetch_rss has been replaced by fetch_feed. http://codex.wordpress.org/Function_Reference/fetch_feed ps. You can ...


3

It is possible to pass an array with allowed protocols to the esc_url() function. For data-URLs this has to contain the data scheme, as this is not whitelisted by wp_allowed_protocols() as default. esc_url( $data_url, array( 'data' ) );


3

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs. If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend against writing SQL queries as it bypasses object caches etc, but if you must write your own SQL, use wpdb to prepare and execute it For calls such as WP_Query, ...


3

I would look into PHP's parse_url() and/or filter_var() with FILTER_VALIDATE_URL filter. parse_url() gives you a bit more control. Combine that with a sanitization as mentioned at the end. Here are couple use cases that will hopefully give you a better idea on how to proceed: If you want to verify that the url's domain is of an approved site: function ...


3

Got this from the soil / roots plugin. did the job for the most part. add_filter( 'style_loader_tag', 'clean_style_tag' ); add_filter( 'script_loader_tag', 'clean_script_tag' ); /** * Clean up output of stylesheet <link> tags */ function clean_style_tag( $input ) { preg_match_all( "!<link rel='stylesheet'\s?(id='[^']+')?\s+href='(.*)' ...


3

The style_loader_tag and script_loader_tag approaches above look like they should work for whatever markup Wordpress is generating, in cases where the theme/plugin is using the proper enqueue functions. If you have offending plugins that don't cooperate (IIRC Jetpack is/was an offender unless a newer version since my recollection has revised this!), and you ...


3

The short answer is "yes", the longer answer is "it depends". Why do you need to validate? because if you have code, which if used with wrong parameters will delete wordpress (very bad example I know), you should made double sure that it is not triggered by some DB corruption, or more likely, misbehaving filter. Lets look at this code which handles the ...


3

The problem is with your selectors: attributes: { content: { type: 'string', source: 'html', selector: 'p', }, content2:{ type: 'string', source: 'html', selector: 'p', }, }, You're only using p for both attributes. When the block looks at the saved HTML to validate it, it checks to see if ...


3

Data Sanitization in Wordpress ... https://developer.wordpress.org/themes/theme-security/data-sanitization-escaping/


2

No, there is no function for that. You would need a complete JavaScript parser. This is not part of the WordPress core.


2

When save_post runs, it has already saved the post on the database. If you are using ACF, it has built-in validation. However, if you need to validate things outside of ACF, such as post_title, things get a little more complicated. Looking into WordPress core code, more specifically at the wp-includes/post.php's update_post() function, there is no built-in ...


Only top voted, non community-wiki answers of a minimum length are eligible