Sanitizing comments or escaping comment_text()
I’m creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation … Read more
sanitization
why is esc_html() returning nothing given a string containing a high-bit character?
In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. … Read more
Sanitizing search data for use with WP_Query
I’m using heavily-customised WordPress to drive a fishkeeping website. I have two separate search areas: a site-wide search and a fish species search. … Read more
I’m confused about URL sanitization in meta boxes
I’m making a meta box for a custom post and this meta box will contain a href value. I don’t need any validation … Read more
How does WordPress store data?
I have looked inside WordPress database. Example: In wp_options table, option_name column, active_plugins row, its option_value is a:7:{i:0;s:27:”clean-html/cleanup-html.php”;i:1;s:59:”force-regenerate-thumbnails/force-regenerate-thumbnails.php”;i:2;s:36:”google-sitemap-generator/sitemap.php”;i:3;s:39:”thumbnail-upscale/thumbnail-upscale.php”;i:4;s:24:”wordpress-seo/wp-seo.php”;i:5;s:27:”wp-super-cache/wp-cache.php”;i:6;s:19:”wptouch/wptouch.php”;} I guess that a is … Read more
Escape hexadecimals/rgba values
I know that sanitize_hex_color exists for sanitizing hexadecimal values going into the database (and only exists in the Customizer), but what’s the best … Read more
Sanitizing `wp_editor();` Values for Database, Edit, and Display
I’m using custom instances of wp_editor(); to allow rich text editing of Post Meta associated with a Post Object. I’d like to perform … Read more
array_map() for sanitizing $_POST
I am working on an options panel for a plugin. And have an array being posted and updated to the options table. I … Read more
What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?
I need to sanitize some custom settings added with the Customize API, namely some simple text fields. Other data types have some dedicated … Read more
How to display data from custom table in wordpress database?
I want to retrieve data from custom table, that I’ve made inside the wordpress database and display it in a wordpress page , … Read more