Do I need to sanitize WordPress search query?

No. WordPress sanitizes the search query.

To use the sanitized search query, use the_search_query() to echo, or get_search_query() to return, the search query.

Edit

Based on your edit:

  • Don’t use $_GET['s']. Use get_search_query().
  • Don’t use $_GET['cat']. Use get_the_category().
  • All $_GET and $_POST data should be assumed to be inherently unsafe, and should be sanitized/validated accordingly.

Leave a Comment