Does wp_insert_post validate the input?

The short answer; absolutely.

wp_insert_post() will only SQL escape the content. Use the KSES library & wp_kses() to filter out the nasties, or esc_html() to escape all HTML.

Most importantly, check out the codex on data validation (read: sanitization).

A Note On KSES: Use wp_filter_kses() or wp_kses_data() to apply the same KSES rules as post comments. The subtle difference between the two is the former expects data escaped with slashes (and returns the same), whilst the latter does not.

WordPress (bizarrely) enforces magic quotes, so $_POST, $_GET (and the like) will have escape slashes added by default.

A Note On wp_insert_post(): This function also expects the data array to have slashes added, so you’ll need to sanitize it with add_magic_quotes() if that’s not the case.

Update: And put in practice;

$_POST['post_title'] = wp_filter_nohtml_kses( $_POST['post_title'] ); // also expects & returns slashes
$_POST['post_content'] = wp_filter_kses( $_POST['post_content'] );

$post_ID = wp_insert_post( $_POST );

// add to the fun - wp_update_post() will add slashes if $postdata is an object!
$update = ( object ) stripslashes_deep( array( 'ID' => $post_ID ) + $_POST );
$update->post_title .= ' Updated!';
wp_update_post( $update )

Related Posts:

  1. Validating input using java.util.Scanner
  2. What is the actual minimum length of an email address as defined by the IETF?
  3. Server side validation
  4. Prevent empty Post Title on form submit via front end post (wp_insert_post_)
  5. WordPress oEmbed W3C Validation
  6. How to Remove novalidate attribute from comment form
  7. What is wp_check_invalid_utf8?
  8. Data Validation
  9. Data Validation: Always escape late / escape HTML Code
  10. Multiple register settings, with same option name – issue
  11. Inconsistent server code response using HTTP API
  12. wordpress site validation errors
  13. Data validation
  14. Best Practice for Validating and Sanitizing Data
  15. Does balanceTags() provide any escaping / protection?
  16. w3c validation problem – Twitter share button pulling content
  17. Data sanitization for user registration and user login
  18. wp_remote_post – handling responses
  19. What data sanitzation function should be used to store entire source code of webpage?
  20. protect user submitted posts
  21. Settings API – getting hidden input / submit button’s name
  22. Why the WP Core team does not allow filter_* functions? [closed]
  23. confused about sanitize_email after is_email [duplicate]
  24. Require user to input code from an array of allowed codes with Gravity Forms [closed]
  25. Output Sanitation
  26. How do I sanitize the str_replace function in javascript variables
  27. WordPress live, custom text box validation, how to?
  28. How to do more than one verify_nonce in one function?
  29. W3C validation errors (trailing slashes)
  30. Jquery Validation Engine with Conatct Form 7
  31. Gravity Forms validate arrival and departure
  32. Why is my script’s regex having its backslash removed?
  33. Validation Always Tells There Is an Open DIV
  34. How long does plugin review usually take?
  35. WP calendar summary attribute validation error
  36. Faster way to wp_insert_post & add_post_meta in bulk
  37. wp_insert_post add meta_input
  38. is_email() VS sanitize_email()
  39. Running WP Cron on specific local time
  40. What is considered the post’s creation date for wp_insert_post?
  41. Add PHP block template to content using wp_insert_post
  42. Create posts without login from frontend
  43. tax_input argument for wp_insert_post()
  44. Create new WordPress post [wp_insert_post] based on results of a WP_Query
  45. wp_insert_post featured image from library
  46. wordpress widget textbox in the sidebar
  47. Replace string with post_name on sidebar
  48. Using table lock with wp_insert_post?
  49. Visual Editor – Colorize Shortcodes
  50. post_status => publish not working
  51. Assignments must be the first block of code on a line Validation Error on Travis
  52. after wp_insert_post need to get the post id
  53. How Can I Set the Post Author of a Post I Just Created With PHP?
  54. Validate form in functions.php, send errors back to template
  55. What is the proper way to validate and sanitize JSON response from REST API?
  56. I would like to password protect my entire WordPress site (ip validated), except for one page
  57. Can’t get wp_insert_post to work
  58. After wp_insert_post(), date_i18n() and date() outputs are adjusted to GMT
  59. using $wpdb to insert a form into a post
  60. update_post_meta, xml parser
  61. Pre insert data when adding new custom post fire a json error
  62. How to save post with different languages and linked them with WPML?
  63. Prevent invalid or empty values from being saved to the database and retain the form field values upon error
  64. Attaching taxonomy data to taxonomy with wp_insert_post
  65. keep wp_insert_post from adding duplicates
  66. Help to upload post attachments from Ajax
  67. Resetting admin post form on JS validation fail
  68. Creating a post from data returned from HTML form
  69. Getting error when using wp_insert_post()
  70. Make post_content and other custom fields required
  71. Flush rewrite rules on option update with Settings API
  72. $user_id = wp_insert_user( $userdata ) Not working no errors
  73. $wpdb->insert() does not insert fields
  74. Fatal error: Call to undefined function wp_insert_post()
  75. insert image with custom post type
  76. wp_insert_post not working fine
  77. Insert data from custom created PHP page into wp_postmeta table
  78. WordPress Frontend Post Form (Bootstrap Modal) Not Creating Post
  79. Inserting current user ID into Post for Author
  80. wp_insert_post creating duplicate post with Safari
  81. How can I correctly redirect user to the submitted post and define a template for each new post in WordPress?
  82. Contact Form 7 WordPress, checking a few fields, if empty then invalid
  83. “transition_post_status” action creating two post with wp_insert_post
  84. validation email signup form buddypress
  85. See if the email exists or not
  86. wp_insert_post deleting previous post custom meta
  87. Updating failed message when a wp_insert_post function is hooked to save_post hook
  88. Creating categories while importing via CSV
  89. wp_insert_post() creates duplicates with ‘post_status’ => ‘publish’
  90. Validating Error with submit button
  91. Custom HTML form using PHP – help with ajax/username validation
  92. Allow users to register on multisite through WooCommerce using the same email address
  93. How to Create Content Remotely
  94. Update post_meta post_name with the post ID from wp_insert_post after user register
  95. Bulk insert posts is really slow and skips entries
  96. Contact Form 7: custom validation [closed]
  97. Update fields with post object and custom tax with wp_insert_post
  98. wp_insert_post with POST data
  99. After wp_insert_post() custom post type does not show in the admin
  100. How to add verification on email address change?

Leave a Comment

error code: 523