Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
16

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation Sanitisation makes things clean and well formed This cleans up the data, e.g. trimming trailing spaces, removing letters in a number field, making an all lowercase ...


15

There are two concepts here: validation - making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation - making the date safe for its use in the current context (e.g. escaping SQL queries, or escaping HTML on output). Validation is, almost universally, ...


14

You can remove the type='*' attributes and values from wp_enqueue'ed scripts and styles, using respective *_loader_tag hooks. The following worked for me: add_action( 'wp_enqueue_scripts', 'myplugin_enqueue' ); function myplugin_enqueue() { // wp_register_script(... // wp_enqueue_script(... } add_filter('style_loader_tag', '...


11

What you need to do is build your own data validation function. Ozh wrote a great tutorial about this earlier, but here's the gist of it ... Assume your options array is called $my_options and it contains three fields, 'text', 'age', and 'isauthorized'. You would still register it the same way: register_setting( 'my_setting', 'my_options', '...


9

Use the native php function Filter Validator if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) { die('Not a valid URL'); }


8

Answering my own question: As suggested by WebElaine I created a completely new block to fix the problem. To make this task easier, I used create-guten-block by Ahmad Awais, which is pretty easy to set up. In init.php I made sure to enqueue my JavaScript and extra CSS for the frontend. This should be straight forward. I recommend reading the Learning ...


7

You need to pass the action to check your nonce against, wp_verify_nonce has two parameters. if($_POST && wp_verify_nonce($_REQUEST['test_slider_options_nonce'],'test_slider_action')) echo "TEST";


6

There's no reason a WordPress site can't pass validation, it's entirely up to the theme designer.


6

You're on the right track. I test the fields in the save_post callback, and then use admin notices to display errors to the user when a field fails validation. They show up just in a highlighted box at the top of the page, just like any errors/messages that WordPress itself generates. Here's a simple example of creating an admin notice: function ...


6

Actually you can bypass login mechanism of wordpress by login user automatically (after they succesfuly passed with credentials from another website for example) with this function: wp_set_auth_cookie($user_id); for example with this you do login admin (user with id = 1) wp_set_auth_cookie(1); //after this admin is logged in so you can create user in ...


6

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn't. The sanitize_email() will ...


6

I know this is an old post, but for anyone visiting it's also worth considering the WP functions esc_url() and esc_url_raw(), the latter being safe for databases entries etc, as it does not encode entities. esc_url() does encode entities and so is good for display to users. In the source you can see that esc_url() checks for a whitelist of allowed ...


6

Approach 1, disable save button What you can do, is to prevent the user from saving the form if the required fields are not filled. This can be simply done via javascript. function require_fields_script(){ echo " <script type='text/javascript'> (function($){ $('#submit').on('click',function(e){ ...


5

Your code works just fine on my end. So, I'd say your problem is elsewhere. Troubleshooting guide. You can use standard debugging or FirePHP. I also use the following for cases where FirePHP doesn't display information, i.e., save_post. function my_log( $msg, $title = '' ) { $error_dir = '/Applications/MAMP/logs/php_error.log'; $date = date( 'd.m....


5

Filter the_category, and remove those attributes: add_filter( 'the_category', 't5_remove_cat_rel' ); function t5_remove_cat_rel( $list ) { return str_replace( array ( 'rel="category tag"', 'rel="category"' ), '', $list ); }


5

One simple way to do it would be to have the user enter just his or her Google Analytics Property ID, instead of having them input the entire JavaScript code. Then you generate the snippet yourself, using their Property ID. According to this Google help page, here is the current Analytics tracking code: <script type="text/javascript"> var _gaq = ...


5

The class-oembed.php file reveals some of the available filters regarding the oEmbeds. We can use the oembed_result or oembed_dataparse filters to modify the HTML fetched from Vimeo before it's cached in the post meta. Here's an example for the latter: add_filter( 'oembed_dataparse', function( $return, $data, $url ) { // Target only Vimeo: if( ...


4

Using $_POST is too low level. Simply give it the same name as your other options. When you options are displayed they should have the names of the form: my_settings[a_particular_option]. For instance: <input name="my_settings[some_input_option]"/> Then for your hidden input and submit button: <input type="hiddden" name="my_settings[foo]" value="...


4

If you have an options page (which should be inside one form), then all data is sent from that form, regardless of whether or not the option has been changed. The array received for validation is the data received from (your part of) the form. If the data is 'empty' it is because the data wasn't sent. Normally this would be because the user has deliberately ...


4

I think the common issue (that I myself have at times) with understanding data validation that we try to approach it as function-centric (which one to use), while it should be approached as process: where data comes from where it goes what unwanted and/or harmful things it might include The confusing amount of function comes from abundance of possible ...


4

The simple reason is that WC3 CSS validation is not very important, you can do better things with your time that will effect your actual users. I'm not saying standards are not important , but with proper testing it is rather easy to ensure compatibility, but strict validation is not followed because many useful techniques are just not valid. For example ...


4

Simply put the wp_insert_post call inside your conditional check so its only called if the post title is not empty, something like this: if (empty($_POST['my_title'])){ echo 'error: please insert a title'; } else { $title = $_POST['my_title']; $new_post = array( 'post_title' => $title, 'post_status' => 'publish', '...


4

I wrote a small plugin that not only validates the input fields on custom post types but also removes the default admin notice, without the use of Javascript. here is some of the code / Validation filters $title = $album->post_title; if ( ! $title ) { $errors['title'] = "The title is required"; } // if we have errors lets setup some messages if (! ...


4

After examining the code and much trial and error, I have a solution: There is a filter - user_profile_update_errors - that is called in the file wp-admin/includes/user.php just after Wordpress does it's own input validation. This filter allows plugins to return their own errors by adding them to a referenced WP_Error class. If any errors exist after the ...


4

WordPress doesn't add the frameborder attribute. YouTube does. It's part of their embed code. If you absolutely must remove it you can use the embed_oembed_html filter to modify the returned HTML: function wpse_308247_remove_frameborder( $html, $url ) { // If the URL to be embedded is from YouTube. if ( strpos( $url, 'youtube.com' ) !== false ) { ...


3

In the articles case, $title is an arbitrary value, as such it should be escaped via html, but, if it was gotten from a WordPress core function it is probably safe, but you should check anyway For example, get_the_title() can contain html markup and is not escaped by default. Eitherway post and page titles should not have html in them. Styling is for ...


3

Not shure if this isn´t a general php question... Use the WP_Error Class. // http://php.net/manual/de/function.is-float.php // http://php.net/manual/de/function.is-int.php // inside your save_post/update_post hooks callback function, // just type cast to float. You could also do a check if it contains non numeric chars // and then simply return; $check = !...


3

Some rel= attributes don't have valid markup, it's really not a big deal, for instance the word tag is HTML valid, but the word category is not. If your loop uses the_category , or wp_list_categories ( I think), you can replace it with the following, function add_nofollow_cat( $text ) { $valid_tag = 'rel="tag"'; $text = str_replace('rel="...


3

Fairly simple using jQuery and global $typenow ex: add_action('admin_print_scripts-post.php', 'my_publish_admin_hook'); add_action('admin_print_scripts-post-new.php', 'my_publish_admin_hook'); function my_publish_admin_hook(){ global $typenow; if (in_array($typenow, array('post','page','mm_photo '))){ ?> <script language="...


3

hook the_posts and inspect each post to see if your shortcode is present, you can use wp_enqueue_style at that point if it is. maybe a bit of regex to check for the presence of the shortcode is the way to go, unfortunately i'm not very good with regex! function wpse27772_has_shortcode($posts) { if ( empty($posts) ) return $posts; $...


Only top voted, non community-wiki answers of a minimum length are eligible