sanitize_meta( string $meta_key, mixed $meta_value, string $object_type, string $object_subtype = '' ): mixed
- Since
- 3.1.3, 4.9.8
- Source
wp-includes/meta.php:1342
Compatibility
- WordPress
- since 4.9.8
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.
Parameters
$meta_keystring- Metadata key.
$meta_valuemixed- Metadata value to sanitize.
$object_typestring- Type of object metadata is for. Accepts 'blog', 'post', 'comment', 'term', 'user', or any other object type with an associated meta table.
$object_subtypestringoptional- The subtype of the object type. Default empty string.Default:
''
Return value
mixed- Sanitized $meta_value.
Performance profile
How much work a call to sanitize_meta() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Trivial
- Scaling
- Constant
- Instructions
- 17–30
- Plugin surface
- 2 hooks
- Called by
- 4
Touches nothing outside its own arguments.
No loop in the body: the same number of instructions runs whatever you pass in.
Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 41.
Third-party callbacks on 'sanitize_{$object_type}_meta_{$meta_key}_for_{$object_subtype}', 'sanitize_{$object_type}_meta_{$meta_key}' run inside this call, and their cost is not bounded by anything here.
4 places in core call this, so the cost is paid more often than your own code shows.
What it touches
- hookthird-party callbacks
apply_filters()called directly
What one call costs · 2 distinct outcomes
One number would be a lie: the work depends on which branch runs. These are every distinct cost sanitize_meta() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
empty($object_subtype) | 17 | apply_filters() |
!empty($object_subtype) | 27–30 | has_filter(), apply_filters() |
Across PHP versions
Compiles the same on PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6-dev: 41 instructions, 17–30 executed per call, 2 branches. The work does not change between versions.
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Hooks and filters fired · 2
2 hooks fire while sanitize_meta() runs, in this order:
- apply_filters( sanitize_{$object_type}_meta_{$meta_key}_for_{$object_subtype} )filterline 1360 (+18 into the body)
Filters the sanitization of a specific meta key of a specific meta type and subtype.
- apply_filters( sanitize_{$object_type}_meta_{$meta_key} )filterline 1377 (+35 into the body)
Filters the sanitization of a specific meta key of a specific meta type.
Uses · 2
- has_filter()Checks if any filter has been registered for a hook.
- apply_filters()Calls the callback functions that have been added to a filter hook.
Used by · 4
- WP_REST_Meta_Fields::is_meta_value_same_as_stored_value()Checks if the user provided value is equivalent to a stored value for the given meta key.
- add_metadata()Adds metadata for the specified object.
- update_metadata()Updates metadata for the specified object. If no value already exists for the specified object ID and metadata key, the metadata will be added.
- update_metadata_by_mid()Updates metadata by meta ID.
Source code
function sanitize_meta( $meta_key, $meta_value, $object_type, $object_subtype = '' ) { if ( ! empty( $object_subtype ) && has_filter( "sanitize_{$object_type}_meta_{$meta_key}_for_{$object_subtype}" ) ) { /** * Filters the sanitization of a specific meta key of a specific meta type and subtype. * * The dynamic portions of the hook name, `$object_type`, `$meta_key`, * and `$object_subtype`, refer to the metadata object type (blog, comment, post, term, or user), * the meta key value, and the object subtype respectively. * * @since 4.9.8 * * @param mixed $meta_value Metadata value to sanitize. * @param string $meta_key Metadata key. * @param string $object_type Type of object metadata is for. Accepts 'blog', 'post', 'comment', 'term', * 'user', or any other object type with an associated meta table. * @param string $object_subtype Object subtype. */ return apply_filters( "sanitize_{$object_type}_meta_{$meta_key}_for_{$object_subtype}", $meta_value, $meta_key, $object_type, $object_subtype ); } /** * Filters the sanitization of a specific meta key of a specific meta type. * * The dynamic portions of the hook name, `$meta_type`, and `$meta_key`, * refer to the metadata object type (blog, comment, post, term, or user) and the meta * key value, respectively. * * @since 3.3.0 * * @param mixed $meta_value Metadata value to sanitize. * @param string $meta_key Metadata key. * @param string $object_type Type of object metadata is for. Accepts 'blog', 'post', 'comment', 'term', * 'user', or any other object type with an associated meta table. */ return apply_filters( "sanitize_{$object_type}_meta_{$meta_key}", $meta_value, $meta_key, $object_type );}Changelog
Introduced in 3.1.3. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
$object_subtype parameter was added.from the docblockAbout this page
- Parsed data
- Generated from the wordpress-develop 7.0.4 tag, from
src/wp-includes/meta.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.