Incorrect Flagging for Sanitization of Arrays
-
When run with the “Plugin Repo” checks, the code throws an incorrect report of
WordPress.Security.ValidatedSanitizedInput.InputNotSanitizedif the variable is an array that is sanitized via anarray_walkin the next step.Here is some illustrative code:
$post_ids = $_POST['selected_posts']; // Should not sanitize this since it is an array. Will sanitize each of its components in the array_walk.
array_walk($post_ids, 'sanitize_text_field');A use-case for the above is, if you are doing a search and replace of certain text across selected posts via the
WP_List_Tableobject, you would want to sanitize the individual post ids rather than the array object. To wit, it is incorrect to callsanitize_text_fieldon an array object.Is there a way to indicate that this is an array, hence the check should not be done here?
The topic ‘Incorrect Flagging for Sanitization of Arrays’ is closed to new replies.