44 votes

Remove type attribute from script and style tags added by WordPress

WordPress 5.3 introduces a considerably simpler way to achieve this. By registering theme support for HTML 5 for script and style, the type="" attribute will be omitted: add_action( '...
Jacob Peattie's user avatar
24 votes
Accepted

Sanitize and data validation with apply_filters() function

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation ...
Tom J Nowell's user avatar
  • 59.2k
18 votes

Remove type attribute from script and style tags added by WordPress

You can remove the type='*' attributes and values from wp_enqueue'ed scripts and styles, using respective *_loader_tag hooks. The following worked for me: add_action( 'wp_enqueue_scripts', '...
David Sword's user avatar
  • 3,327
16 votes
Accepted

Validation error: Extending Gutenberg gallery block

Answering my own question: As suggested by WebElaine I created a completely new block to fix the problem. To make this task easier, I used create-guten-block by Ahmad Awais, which is pretty easy to ...
Andreas's user avatar
  • 331
8 votes

How to check if a string is a valid URL

I found wp_http_validate_url quite convenient to check if a string in valid URL or not while working on my project. Take a reference from here: https://developer.wordpress.org/reference/functions/...
Ashish Shrestha's user avatar
6 votes
Accepted

edit profile validation refreshes all field if missing wordpress

Approach 1, disable save button What you can do, is to prevent the user from saving the form if the required fields are not filled. This can be simply done via javascript. function ...
Johansson's user avatar
  • 15.3k
6 votes
Accepted

WordPress REST API validation

There is no such maxLength option in the WP REST API. You can pass a validate_callback though. Example: <?php add_action( 'rest_api_init', function () { register_rest_route( 'myplugin/v1', '/...
swissspidy's user avatar
  • 3,814
6 votes
Accepted

Remove frameborder attribute from iframes

WordPress doesn't add the frameborder attribute. YouTube does. It's part of their embed code. If you absolutely must remove it you can use the embed_oembed_html filter to modify the returned HTML: ...
Jacob Peattie's user avatar
4 votes

Make post_content and other custom fields required

Don't rely entirely on JavaScript validations. Use below hook for Server side validation. function check_if_post_content_set( $maybe_empty, $postarr ) { // Check if post is already created. ...
JItendra Rana's user avatar
4 votes
Accepted

Wordpress-gutenberg - Block validation: Expected text

The problem is with your selectors: attributes: { content: { type: 'string', source: 'html', selector: 'p', }, content2:{ type: 'string', source: '...
Jacob Peattie's user avatar
3 votes
Accepted

Validation Function for URL in plugin

I would look into PHP's parse_url() and/or filter_var() with FILTER_VALIDATE_URL filter. parse_url() gives you a bit more control. Combine that with a sanitization as mentioned at the end. Here are ...
hwl's user avatar
  • 2,115
3 votes
Accepted

Who is responsible for data sanitization in WordPress development?

Yes, WordPress will sanitise data on its way to the database, so long as you use the APIs. If you're using the wpdb object however you'll need to use the prepare method to sanitise. I recommend ...
Tom J Nowell's user avatar
  • 59.2k
3 votes
Accepted

What is the best practice for escaping data URIs?

It is possible to pass an array with allowed protocols to the esc_url() function. For data-URLs this has to contain the data scheme, as this is not whitelisted by wp_allowed_protocols() as default. ...
JHoffmann's user avatar
  • 1,830
3 votes

Remove type attribute from script and style tags added by WordPress

Got this from the soil / roots plugin. did the job for the most part. add_filter( 'style_loader_tag', 'clean_style_tag' ); add_filter( 'script_loader_tag', 'clean_script_tag' ); /** * Clean ...
kiwiot's user avatar
  • 51
3 votes

Remove type attribute from script and style tags added by WordPress

The style_loader_tag and script_loader_tag approaches above look like they should work for whatever markup Wordpress is generating, in cases where the theme/plugin is using the proper enqueue ...
firxworx's user avatar
  • 241
3 votes
Accepted

Is it necessary to do validation again when retrieving data from database?

The short answer is "yes", the longer answer is "it depends". Why do you need to validate? because if you have code, which if used with wrong parameters will delete wordpress (very bad example I know)...
Mark Kaplun's user avatar
  • 23.4k
3 votes

Is there a maximum length to user passwords?

The upper limit for password length in WordPress is 4096 characters bytes, at present. This has been the case since 2014. If WordPress eventually switches to using the built in PHP password_hash ...
Otto's user avatar
  • 32.6k
3 votes
Accepted

How to define a query parameter with REST API?

Yes, from the link you posted there are examples for both sanitising and validating the parameters. Validating does a check which can fail and block the API call from running; sanitising just does ...
mozboz's user avatar
  • 2,558
3 votes
Accepted

register_setting & add_settings_error validation issues with multiple fields

If you want your sanitization callback to apply only to a specific settings field (i.e. a database option registered using register_setting()), then you would want to use a different callback for each ...
Sally CJ's user avatar
  • 39.2k
3 votes

Settings API - sanitize_callback is not called and it leads to an incorrect behavior

If I take the value sanitize_callback out of the argument array completely, everything works as desired, so error-free. Yes, and that's because you used the wrong callable syntax which then causes ...
Sally CJ's user avatar
  • 39.2k
3 votes
Accepted

Display notice in block editor after wp_insert_post_data hook

what I cannot understand is how to call the javascript function (file already enqueued in admin) after the validation from wp_insert_post_data You can use the same approach that Gutenberg uses for ...
Sally CJ's user avatar
  • 39.2k
2 votes

How to validate custom fields in custom post type?

When save_post runs, it has already saved the post on the database. If you are using ACF, it has built-in validation. However, if you need to validate things outside of ACF, such as post_title, things ...
Lucas Bustamante's user avatar
2 votes
Accepted

Calling JavaScript file with Custom Plugin

WP loads jQuery in no conflict mode so shortcut $ is not available for jQuery to use .You should not use the $ variable for jQuery within WordPress. jQuery(function ($) { //code here }) or (...
bravokeyl's user avatar
  • 3,359
2 votes

How to validate custom field on lost password form before the user id field?

Actually I found what I need. Using the action lostpassword_post I can add errors before wordpress checks if the username or email is valid. It does not stop wordpress from checking if the username or ...
Nikolay's user avatar
  • 504
2 votes
Accepted

Require user to input code from an array of allowed codes with Gravity Forms

Try below code: add_filter( 'gform_field_validation', 'custom_validation', 10, 4 ); function custom_validation( $result, $value, $form, $field ) { $arrWhitelist = array('XH6D', '8U2A', 'L9D3'); ...
AddWeb Solution Pvt Ltd's user avatar
2 votes
Accepted

How to use esc_attr__() function properly to translate a variable that contains string?

If you have static text with dynamic content then you can use. printf( esc_attr___('static text goes here with %s', 'text-domain' ), $title ); If you have only $title then no need to translate it. ...
maheshwaghmare's user avatar
2 votes

Sanitizing text fields in array

Wordpress use add_magic_quotes() to escape incoming data from $_POST, $_GET and $_COOKIEand $_SERVERin load.php on line 647. You can use structur of this function to build Your own function which can ...
sebastian_aps's user avatar
2 votes

How to check if a string is a valid URL

In my opinion is better to use wp_http_validate_url. Example 1: filter_var( '//website.com', FILTER_VALIDATE_URL ) Return false. Example 2: wp_http_validate_url( '//website.com' ) Return url. If ...
Daniel's user avatar
  • 21
2 votes

How to escape multiple attribute at once in WordPress?

The reason you escape attributes is to make sure that the values don't have any characters that will break the HTML of the element. For example, if you didn't escape: $attr = 'foo"> <script>...
Jacob Peattie's user avatar
2 votes
Accepted

Error in Validate Field with ACF plugin in Wordpress

I did have the same issue. And I wasted enough time for the answer. At first be sure that: The ajax request isn't failed and happens. So, check: Is acf_form_head() before get_header() and run ...
Kostiantyn Petlia's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible