40 votes

Remove type attribute from script and style tags added by WordPress

WordPress 5.3 introduces a considerably simpler way to achieve this. By registering theme support for HTML 5 for script and style, the type="" attribute will be omitted: add_action( '...
user avatar
22 votes
Accepted

Sanitize and data validation with apply_filters() function

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation ...
user avatar
  • 52.4k
17 votes

Remove type attribute from script and style tags added by WordPress

You can remove the type='*' attributes and values from wp_enqueue'ed scripts and styles, using respective *_loader_tag hooks. The following worked for me: add_action( 'wp_enqueue_scripts', '...
user avatar
  • 3,227
14 votes
Accepted

Validation error: Extending Gutenberg gallery block

Answering my own question: As suggested by WebElaine I created a completely new block to fix the problem. To make this task easier, I used create-guten-block by Ahmad Awais, which is pretty easy to ...
user avatar
  • 311
13 votes
Accepted

How to check if a string is a valid URL

Use the native php function Filter Validator if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) { die('Not a valid URL'); }
user avatar
  • 4,900
10 votes
Accepted

is_email() VS sanitize_email()

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not ...
user avatar
6 votes

How to check if a string is a valid URL

I found wp_http_validate_url quite convenient to check if a string in valid URL or not while working on my project. Take a reference from here: https://developer.wordpress.org/reference/functions/...
user avatar
6 votes

How to check if a string is a valid URL

I know this is an old post, but for anyone visiting it's also worth considering the WP functions esc_url() and esc_url_raw(), the latter being safe for databases entries etc, as it does not encode ...
user avatar
  • 855
6 votes
Accepted

edit profile validation refreshes all field if missing wordpress

Approach 1, disable save button What you can do, is to prevent the user from saving the form if the required fields are not filled. This can be simply done via javascript. function ...
user avatar
  • 14.6k
6 votes
Accepted

WordPress REST API validation

There is no such maxLength option in the WP REST API. You can pass a validate_callback though. Example: <?php add_action( 'rest_api_init', function () { register_rest_route( 'myplugin/v1', '/...
user avatar
  • 3,644
6 votes
Accepted

Remove frameborder attribute from iframes

WordPress doesn't add the frameborder attribute. YouTube does. It's part of their embed code. If you absolutely must remove it you can use the embed_oembed_html filter to modify the returned HTML: ...
user avatar
5 votes
Accepted

WordPress oEmbed W3C Validation

The class-oembed.php file reveals some of the available filters regarding the oEmbeds. We can use the oembed_result or oembed_dataparse filters to modify the HTML fetched from Vimeo before it's ...
user avatar
  • 64k
4 votes

Make post_content and other custom fields required

Don't rely entirely on JavaScript validations. Use below hook for Server side validation. function check_if_post_content_set( $maybe_empty, $postarr ) { // Check if post is already created. ...
user avatar
3 votes
Accepted

Why the WP Core team does not allow filter_* functions?

Because on the minimum version required it isn't always available since the SPL can be disabled on PHP 5.2 and below. The majority of installs running WordPress have it, but not all, and it's the same ...
user avatar
  • 52.4k
3 votes
Accepted

Flush rewrite rules on option update with Settings API

I register custom post type on init action and the validate which I'm writing about is set to register_setting inside admin_init action. This is the key to your issue. You're registering the custom ...
user avatar
  • 32.1k
3 votes

Validate Uploaded Image using WordPress' Built-in Functions?

All of the code in your question can be replaced with: require_once( ABSPATH . 'wp-admin/includes/image.php' ); require_once( ABSPATH . 'wp-admin/includes/file.php' ); require_once( ABSPATH . 'wp-...
user avatar
  • 52.4k
3 votes
Accepted

What is the best practice for escaping data URIs?

It is possible to pass an array with allowed protocols to the esc_url() function. For data-URLs this has to contain the data scheme, as this is not whitelisted by wp_allowed_protocols() as default. ...
user avatar
  • 1,771
3 votes
Accepted

Who is responsible for data sanitization in WordPress development?

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs. If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend ...
user avatar
  • 52.4k
3 votes
Accepted

Validation Function for URL in plugin

I would look into PHP's parse_url() and/or filter_var() with FILTER_VALIDATE_URL filter. parse_url() gives you a bit more control. Combine that with a sanitization as mentioned at the end. Here are ...
user avatar
  • 2,085
3 votes

Remove type attribute from script and style tags added by WordPress

Got this from the soil / roots plugin. did the job for the most part. add_filter( 'style_loader_tag', 'clean_style_tag' ); add_filter( 'script_loader_tag', 'clean_script_tag' ); /** * Clean ...
user avatar
  • 51
3 votes

Remove type attribute from script and style tags added by WordPress

The style_loader_tag and script_loader_tag approaches above look like they should work for whatever markup Wordpress is generating, in cases where the theme/plugin is using the proper enqueue ...
user avatar
  • 241
3 votes
Accepted

Is it necessary to do validation again when retrieving data from database?

The short answer is "yes", the longer answer is "it depends". Why do you need to validate? because if you have code, which if used with wrong parameters will delete wordpress (very bad example I know)...
user avatar
  • 22.7k
3 votes
Accepted

Wordpress-gutenberg - Block validation: Expected text

The problem is with your selectors: attributes: { content: { type: 'string', source: 'html', selector: 'p', }, content2:{ type: 'string', source: '...
user avatar
3 votes
Accepted

Form validation in WordPress Admin Panel

Data Sanitization in Wordpress ... https://developer.wordpress.org/themes/theme-security/data-sanitization-escaping/
user avatar
  • 450
2 votes
Accepted

Sanitizing and validating email field

According to the documentation, is_email() is used to validate an email and either returns the email if it is valid or false if it isn't. So are using it correctly. The only thing I can see in your ...
user avatar
  • 3,358
2 votes
Accepted

Add Div to Comment Form

If you want to add some custom HTML between the </h3> and the <form> tags, you can try the following: /** * Add custom HTML between the `</h3>` and the `<form>` tags in the ...
user avatar
  • 64k
2 votes

How to validate custom fields in custom post type?

When save_post runs, it has already saved the post on the database. If you are using ACF, it has built-in validation. However, if you need to validate things outside of ACF, such as post_title, things ...
user avatar
2 votes

don't publish custom post type post if a meta data field isn't valid

you have to check/validate your meta field value on ajax i.e. when user hit "Publish/Update" button. Here i am validating woocommerce product having meta field "product_number" for empty value. ...
user avatar
2 votes
Accepted

Warn user that data may be lost for custom pages

you have to make a javascript code similar to this... jQuery(function ($) { name = $('#name').val(); $('#name').data('old_value',name); window.onbeforeunload = function () { if (...
user avatar
2 votes
Accepted

Validate form in functions.php, send errors back to template

You need a filter not an action. Something like this (notes are commented into the code. You have a few PHP errors that you need to correct): function signup_validate_insert($post){ $errors = false;...
user avatar
  • 63.6k

Only top scored, non community-wiki answers of a minimum length are eligible