sanitize_option() WordPress Function
The sanitize_option() function is used to clean up options before they are saved to the database. This function is called by the update_option() function.
sanitize_option( string $option, string $value ) #
Sanitizes various option values based on the nature of the option.
Description
This is basically a switch statement which will pass $value through a number of functions depending on the $option.
Parameters
- $option
(string)(Required)The name of the option.
- $value
(string)(Required)The unsanitised value.
Return
(string) Sanitized value.
More Information
After the value has been handled by the functions in the switch statement, it will be passed through a sanitize_option_$option filter.
New options can be defined by adding an appropriate sanitize_option_$option filter (e.g. ‘sanitize_option_avatar’ for a filter for an ‘avatar’ option)
Existing options handled by sanitize_option():
admin_email
new_admin_email
thumbnail_size_w
thumbnail_size_h
medium_size_w
medium_size_h
large_size_w
large_size_h
mailserver_port
comment_max_links
page_on_front
page_for_posts
rss_excerpt_length
default_category
default_email_category
default_link_category
close_comments_days_old
comments_per_page
thread_comments_depth
users_can_register
start_of_week
posts_per_page
posts_per_rss
default_ping_status
default_comment_status
blogdescription
blogname
blog_charset
blog_public
date_format
time_format
mailserver_url
mailserver_login
mailserver_pass
upload_path
ping_sites
gmt_offset
siteurl
home
WPLANG
illegal_names
limited_email_domains
banned_email_domains
timezone_string
permalink_structure
category_base
tag_base
Source
File: wp-includes/formatting.php
function sanitize_option( $option, $value ) { global $wpdb; $original_value = $value; $error = null; switch ( $option ) { case 'admin_email': case 'new_admin_email': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { $value = sanitize_email( $value ); if ( ! is_email( $value ) ) { $error = __( 'The email address entered did not appear to be a valid email address. Please enter a valid email address.' ); } } break; case 'thumbnail_size_w': case 'thumbnail_size_h': case 'medium_size_w': case 'medium_size_h': case 'medium_large_size_w': case 'medium_large_size_h': case 'large_size_w': case 'large_size_h': case 'mailserver_port': case 'comment_max_links': case 'page_on_front': case 'page_for_posts': case 'rss_excerpt_length': case 'default_category': case 'default_email_category': case 'default_link_category': case 'close_comments_days_old': case 'comments_per_page': case 'thread_comments_depth': case 'users_can_register': case 'start_of_week': case 'site_icon': $value = absint( $value ); break; case 'posts_per_page': case 'posts_per_rss': $value = (int) $value; if ( empty( $value ) ) { $value = 1; } if ( $value < -1 ) { $value = abs( $value ); } break; case 'default_ping_status': case 'default_comment_status': // Options that if not there have 0 value but need to be something like "closed". if ( '0' == $value || '' === $value ) { $value = 'closed'; } break; case 'blogdescription': case 'blogname': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( $value !== $original_value ) { $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', wp_encode_emoji( $original_value ) ); } if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { $value = esc_html( $value ); } break; case 'blog_charset': $value = preg_replace( '/[^a-zA-Z0-9_-]/', '', $value ); // Strips slashes. break; case 'blog_public': // This is the value if the settings checkbox is not checked on POST. Don't rely on this. if ( null === $value ) { $value = 1; } else { $value = (int) $value; } break; case 'date_format': case 'time_format': case 'mailserver_url': case 'mailserver_login': case 'mailserver_pass': case 'upload_path': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { $value = strip_tags( $value ); $value = wp_kses_data( $value ); } break; case 'ping_sites': $value = explode( "\n", $value ); $value = array_filter( array_map( 'trim', $value ) ); $value = array_filter( array_map( 'esc_url_raw', $value ) ); $value = implode( "\n", $value ); break; case 'gmt_offset': $value = preg_replace( '/[^0-9:.-]/', '', $value ); // Strips slashes. break; case 'siteurl': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { if ( preg_match( '#http(s?)://(.+)#i', $value ) ) { $value = esc_url_raw( $value ); } else { $error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' ); } } break; case 'home': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { if ( preg_match( '#http(s?)://(.+)#i', $value ) ) { $value = esc_url_raw( $value ); } else { $error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' ); } } break; case 'WPLANG': $allowed = get_available_languages(); if ( ! is_multisite() && defined( 'WPLANG' ) && '' !== WPLANG && 'en_US' !== WPLANG ) { $allowed[] = WPLANG; } if ( ! in_array( $value, $allowed, true ) && ! empty( $value ) ) { $value = get_option( $option ); } break; case 'illegal_names': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { if ( ! is_array( $value ) ) { $value = explode( ' ', $value ); } $value = array_values( array_filter( array_map( 'trim', $value ) ) ); if ( ! $value ) { $value = ''; } } break; case 'limited_email_domains': case 'banned_email_domains': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { if ( ! is_array( $value ) ) { $value = explode( "\n", $value ); } $domains = array_values( array_filter( array_map( 'trim', $value ) ) ); $value = array(); foreach ( $domains as $domain ) { if ( ! preg_match( '/(--|\.\.)/', $domain ) && preg_match( '|^([a-zA-Z0-9-\.])+$|', $domain ) ) { $value[] = $domain; } } if ( ! $value ) { $value = ''; } } break; case 'timezone_string': $allowed_zones = timezone_identifiers_list(); if ( ! in_array( $value, $allowed_zones, true ) && ! empty( $value ) ) { $error = __( 'The timezone you have entered is not valid. Please select a valid timezone.' ); } break; case 'permalink_structure': case 'category_base': case 'tag_base': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { $value = esc_url_raw( $value ); $value = str_replace( 'http://', '', $value ); } if ( 'permalink_structure' === $option && null === $error && '' !== $value && ! preg_match( '/%[^\/%]+%/', $value ) ) { $error = sprintf( /* translators: %s: Documentation URL. */ __( 'A structure tag is required when using custom permalinks. <a href="%s">Learn more</a>' ), __( 'https://wordpress.org/support/article/using-permalinks/#choosing-your-permalink-structure' ) ); } break; case 'default_role': if ( ! get_role( $value ) && get_role( 'subscriber' ) ) { $value = 'subscriber'; } break; case 'moderation_keys': case 'disallowed_keys': $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); if ( is_wp_error( $value ) ) { $error = $value->get_error_message(); } else { $value = explode( "\n", $value ); $value = array_filter( array_map( 'trim', $value ) ); $value = array_unique( $value ); $value = implode( "\n", $value ); } break; } if ( null !== $error ) { if ( '' === $error && is_wp_error( $value ) ) { /* translators: 1: Option name, 2: Error code. */ $error = sprintf( __( 'Could not sanitize the %1$s option. Error code: %2$s' ), $option, $value->get_error_code() ); } $value = get_option( $option ); if ( function_exists( 'add_settings_error' ) ) { add_settings_error( $option, "invalid_{$option}", $error ); } } /** * Filters an option value following sanitization. * * @since 2.3.0 * @since 4.3.0 Added the `$original_value` parameter. * * @param string $value The sanitized option value. * @param string $option The option name. * @param string $original_value The original value passed to the function. */ return apply_filters( "sanitize_option_{$option}", $value, $option, $original_value ); }
Expand full source codeCollapse full source codeView on TracView on GitHub
Changelog
Version | Description |
---|---|
2.0.5 | Introduced. |