User Contributed Notes

1. Skip to note 6 content

   
   mcmwebsol
   
   
   5 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 6You must log in to vote on the helpfulness of this note

   This function is not for protecting against SQL injection, so please don’t use it in your database queries. In most cases using https://developer.wordpress.org/reference/classes/wpdb/prepare/ with placeholders is best for database queries.

2. Skip to note 7 content

   
   bhvreddy
   
   
   4 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 5You must log in to vote on the helpfulness of this note

   Sanitize an array

   map_deep( $form_data, 'sanitize_text_field' );

3. Skip to note 8 content

   
   凱寧
   
   
   6 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 3You must log in to vote on the helpfulness of this note

   Check whether the string is a valid UTF-8 character, and remove all HTML tags.

   $str = "<h2>Title</h2>";
   sanitize_text_field( $str ); // it will return "title" without any HTML tags!

   • This will not convert text string to lower case as stated in your comment ” it will return ‘title’ without any HTML tags!” make it “it will return ‘Title’ without any HTML tags!’

     bharatthapa 5 years ago

4. Skip to note 9 content

   
   Douglas “BearlyDoug” Hazard
   
   
   5 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note

   I ran across an issue with one of my plugins, as it was going through the initial security review, where I had an array that wasn’t passing a security check. The sanitize_text_field() function only works on a string, not an array’d item.

   I located this nice little tidbit of code to sanitize an array, properly.

   /***
    * To ensure arrays are properly sanitized to WordPress Codex standards,
    * they encourage usage of sanitize_text_field(). That only works with a single
    * variable (string). This function allows for a full blown array to get sanitized
    * properly, while sanitizing each individual value in a key -> value pair.
    *
    * Source: <a href="https://wordpress.stackexchange.com/questions/24736/wordpress-sanitize-array" rel="nofollow ugc">https://wordpress.stackexchange.com/questions/24736/wordpress-sanitize-array</a>
    * Author: Broshi, answered Feb 5 '17 at 9:14
    */
   function wporg_recursive_sanitize_text_field( $array ) {
   	foreach ( $array as $key => &$value ) {
   		if ( is_array( $value ) ) {
   			$value = wporg_recursive_sanitize_text_field( $value );
   		} else {
   			$value = sanitize_text_field( $value );
   		}
   	}
   	return $array;
   }

   IMHO, this needs to become a core feature of WordPress’ sanitation functions. Lior Broshi is the gentleman that came up with this creative solution (I have obtained his permission to share this).

   • Sanitize an array

     map_deep( $form_data, 'sanitize_text_field' );

     bhvreddy 4 years ago

   • We handle this by using the array_map, it gets a bit tricky if the array contains various field types (text fields, emails etc) but it can be done using: $sanitized_array = array_map( 'sanitize_text_field', $array );

     Andrew Lima 1 year ago

5. Skip to note 10 content

   
   thejaydip
   
   
   10 months ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note

   <br />
$unsafe_input = 'alert("XSS")hello';<br />
$safe_input = sanitize_text_field($unsafe_input);<br />
echo $safe_input; // Output: hello<br />


   Use sanitize_text_field() when:
   (1) You’re handling free-form user input from forms, URLs, or APIs.
   (2) The value will be stored in the database, output in HTML, or used in queries.