validation

How to validate custom fields in custom post type?

by

I wrote a plugin that creates a custom post type with custom fields. To prevent users from entering incorrect information, how can I validate the data? I assumed that the save_post hook function would process field validation, but I can’t seem to find a straight forward way that displays errors back to the user. Is … Read more

Sanitize and data validation with apply_filters() function

by

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( ‘slug_excerpt_length’, 35 ) ); wp_kses_post( apply_filters( ‘slug_excerpt_more’, ‘…’ ) ); esc_url( apply_filters( ‘slug_login_url’, home_url( “https://wordpress.stackexchange.com/” ) ) ); I am asking this question, cause I have never seen this before. Actually we add some validation to prevent breaking something when the user … Read more

How to validate phone numbers using regex

by

I’m trying to put together a comprehensive regex to validate phone numbers. Ideally it would handle international formats, but it must handle US formats, including the following: 1-234-567-8901 1-234-567-8901 x1234 1-234-567-8901 ext1234 1 (234) 567-8901 1.234.567.8901 1/234/567/8901 12345678901 I’ll answer with my current attempt, but I’m hoping somebody has something better and/or more elegant. 42 … Read more

How does the SQL injection from the “Bobby Tables” XKCD comic work?

by

Just looking at: (Source: https://xkcd.com/327/) What does this SQL do: Robert’); DROP TABLE STUDENTS; — I know both ‘ and — are for comments, but doesn’t the word DROP get commented as well since it is part of the same line? 1 13 It drops the students table. The original code in the school’s program … Read more

How to check if a string is a valid URL

by

WordPress provides a helpful function called is_email() which checks if a given email address is valid. Is there a similar function available to check if a URL is valid? I tried is_url() but that was just wishful thinking on my part. Ref: http://codex.wordpress.org/Function_Reference/is_email 7 Use the native php function Filter Validator if (filter_var($url, FILTER_VALIDATE_URL) === … Read more

don’t publish custom post type post if a meta data field isn’t valid

by

I have a custom post type (CPT) called event. I have a meta box for the type with several fields. I would like to validate some fields before publishing an event. For example, if an event’s date is not specified I would like to display an informative error message, save the event for future editing, … Read more

A potentially dangerous Request.Form value was detected from the client

by

Every time a user posts something containing < or > in a page in my web application, I get this exception thrown. I don’t want to go into the discussion about the smartness of throwing an exception or crashing an entire web application because somebody entered a character in a text box, but I am … Read more