sanitize_text_field( string $str ): string

User Contributed Notes

1. Skip to note 5 content

   mcmwebsol 3 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 6You must log in to vote on the helpfulness of this note

   This function is not for protecting against SQL injection, so please don’t use it in your database queries. In most cases using https://developer.wordpress.org/reference/classes/wpdb/prepare/ with placeholders is best for database queries.
2. Skip to note 6 content

   bhvreddy 3 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 5You must log in to vote on the helpfulness of this note

   Sanitize an array

   map_deep( $form_data, 'sanitize_text_field' );
3. Skip to note 7 content

   凱寧 4 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 3You must log in to vote on the helpfulness of this note

   Check whether the string is a valid UTF-8 character, and remove all HTML tags.

   $str = "<h2>Title</h2>";
   sanitize_text_field( $str ); // it will return "title" without any HTML tags!

   • This will not convert text string to lower case as stated in your comment ” it will return ‘title’ without any HTML tags!” make it “it will return ‘Title’ without any HTML tags!’

     bharatthapa 3 years ago
4. Skip to note 8 content

   Douglas “BearlyDoug” Hazard 4 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note

   I ran across an issue with one of my plugins, as it was going through the initial security review, where I had an array that wasn’t passing a security check. The sanitize_text_field() function only works on a string, not an array’d item.

   I located this nice little tidbit of code to sanitize an array, properly.

   /***
    * To ensure arrays are properly sanitized to WordPress Codex standards,
    * they encourage usage of sanitize_text_field(). That only works with a single
    * variable (string). This function allows for a full blown array to get sanitized
    * properly, while sanitizing each individual value in a key -> value pair.
    *
    * Source: https://wordpress.stackexchange.com/questions/24736/wordpress-sanitize-array
    * Author: Broshi, answered Feb 5 '17 at 9:14
    */
   function wporg_recursive_sanitize_text_field( $array ) {
   	foreach ( $array as $key => &$value ) {
   		if ( is_array( $value ) ) {
   			$value = wporg_recursive_sanitize_text_field( $value );
   		} else {
   			$value = sanitize_text_field( $value );
   		}
   	}
   	return $array;
   }

   IMHO, this needs to become a core feature of WordPress’ sanitation functions. Lior Broshi is the gentleman that came up with this creative solution (I have obtained his permission to share this).

   • Sanitize an array

     map_deep( $form_data, 'sanitize_text_field' );

     bhvreddy 3 years ago