Question

It looks to me that when saving data to the database via the settings API Wordpress sanitizes data by default. By that I mean that if I look at the raw settings options in the database they have (at the very least) been through the wordpress equivalent of htmlentities(). Is there any documentation of the exact sanitization process? I don't want to repeat any of it in my own validation function, and want to make sure I'm using the data correctly when I call it back.....

UPDATE: In response to Christopher Davis's great answer, here is a bit more detail. I am using register_setting to register a group of settings. This group is set using the add_settings_field. The array of all settings is passed (using the register_settings callback) to a single validation method, which just checks that everything looks right (i.e. reg exp checking that an email is an email, an integer is an integer etc). I am doing no sanitisation, or referencing any of the Wordpress sanitisation methods. However one option value contains a tag, which when viewed in the database has been converted to HTML entities. I assumed Wordpress was doing (at least) this by default for any options stored in the database. Perhaps just by the way it converts an array to a string to store it in the database?

No correct solution

Licensed under: CC-BY-SA with attribution
Not affiliated with wordpress.stackexchange
scroll top