The general guideline is that we should sanitize all user input before using them.

Now my questions is whether this applies to nonce or not.

Which one is correct?

wp_verify_nonce( sanitize_text_field( $_GET['some_nonce'] ), 'some_nonce' );

or

wp_verify_nonce( _GET['some_nonce'], 'some_nonce' );

1 Answer
1

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.

wp_verify_nonce function checks $nonce value like this:

if ( hash_equals( $expected, $nonce ) ) {
    return 1;
}

For this you don’t need sanitizing. So the following is fine:

wp_verify_nonce( $_GET['some_nonce'], 'some_nonce' );

Leave a Reply

Your email address will not be published. Required fields are marked *