Data Sanitization/Escaping

Sanitization: Securing Input #Sanitization: Securing Input

Sanitization is the process of cleaning or filtering your input data. Whether the data is from a user or an API or web service, you use sanitizing when you don’t know what to expect or you don’t want to be strict with data validation.

The easiest way to sanitize data is with built-in WordPress functions.

The sanitize_*() series of helper functions provide an effective way to ensure you’re ending up with safe data, and they require minimal effort on your part:

• sanitize_email()
• sanitize_file_name()
• sanitize_html_class()
• sanitize_key()
• sanitize_meta()
• sanitize_mime_type()
• sanitize_option()
• sanitize_sql_orderby()
• sanitize_text_field()
• sanitize_title()
• sanitize_title_for_query()
• sanitize_title_with_dashes()
• sanitize_user()
• esc_url_raw()
• wp_filter_post_kses()
• wp_filter_nohtml_kses()

Example -Simple Input Field #Example -Simple Input Field

Let’s say we have an input field named title.

<input id="title" type="text" name="title">

You can sanitize the input data with the sanitize_text_field() function:

$title = sanitize_text_field( $_POST['title'] );
update_post_meta( $post->ID, 'title', $title );

Behind the scenes, sanitize_text_field() does the following:

• Checks for invalid UTF-8
• Converts single less-than characters (<) to entity
• Strips all tags
• Removes line breaks, tabs and extra white space
• Strips octets

Top ↑

Escaping: Securing Output #Escaping: Securing Output

Whenever you’re outputting data make sure to properly escape it.

Escaping is the process of securing output by stripping out unwanted data, like malformed HTML or script tags, preventing this data from being seen as code.

Escaping helps secure your data prior to rendering it for the end user and prevents XSS (Cross-site scripting) attacks.

WordPress has a few helper functions you can use for most common scenarios.

• esc_html() – Use this function anytime an HTML element encloses a section of data being displayed.

<?php echo esc_html( $title ); ?>

• esc_url() – Use this function on all URLs, including those in the src and href attributes of an HTML element.

<img src="<?php echo esc_url( $great_user_picture_url ); ?>" />

• esc_js() – Use this function for inline Javascript.

<a href="#" onclick="<?php echo esc_js( $custom_js ); ?>">Click me</a>

• esc_attr() – Use this function on everything else that’s printed into an HTML element’s attribute.

<ul class="<?php echo esc_attr( $stored_class ); ?>"> </ul>

• esc_textarea() – encodes text for use inside a textarea element.

<textarea><?php echo esc_textarea( $text ); ?></textarea>

Top ↑

Escaping with Localization #Escaping with Localization

Rather than using echo to output data, it’s common to use the WordPress localization functions, such as _e() or __().

These functions simply wrap a localization function inside an escaping function:

esc_html_e( 'Hello World', 'text_domain' );
// same as
echo esc_html( __( 'Hello World', 'text_domain' ) );

These helper functions combine localization and escaping:

• esc_html__()
• esc_html_e()
• esc_html_x()
• esc_attr__()
• esc_attr_e()
• esc_attr_x()

Top ↑

Custom Escaping #Custom Escaping

In the case that you need to escape your output in a specific way, the function wp_kses() (pronounced “kisses”) will come in handy. For example, there are instances when your want HTML elements or attributes to display in your output.

This function makes sure that only the specified HTML elements, attributes, and attribute values will occur in your output, and normalizes HTML entities.

$allowed_html = [
    'a'      => [
        'href'  => [],
        'title' => [],
    ],
    'br'     => [],
    'em'     => [],
    'strong' => [],
];
echo wp_kses( $custom_content, $allowed_html );

wp_kses_post() is a wrapper function for wp_kses where $allowed_html is a set of rules used by post content.

echo wp_kses_post( $post_content );

Top ↑

Database Escaping #Database Escaping

All data in SQL queries must be SQL-escaped before the SQL query is executed to prevent against SQL injection attacks. WordPress provides helper classes to assist with escaping SQL queries $wpdb.

Top ↑

Selecting Data #Selecting Data

The escaped SQL query ($sql in this example) can then be used with one of the methods:

• $wpdb->get_row($sql)
• $wpdb->get_var($sql)
• $wpdb->get_results($sql)
• $wpdb->get_col($sql)
• $wpdb->query($sql)

Top ↑

Inserting and Updating Data #Inserting and Updating Data

• $wpdb->update()
• $wpdb->insert()

Top ↑

Like Statements #Like Statements

• $wpdb->prepare