Should I Worry About SQL Injection When Using wp_insert_post?

WordPress DOES take care of SQL injection and for you. See the Security section on this page. The wp_insert_post() function runs through sanitize_post().

Be aware that malicious or unintended code can still be inserted:

“You may wish, however, to remove HTML, JavaScript, and PHP tags from
the post_title and any other fields. Surprisingly, WordPress does
not do this automatically. This can be easily done by using the
wp_strip_all_tags() function and is especially useful when building
front-end post submission forms.”

Should you not want to strip ALL tags, Validating Sanitizing and Escaping User Data is a good page to start looking for specific sanitation rules that are built in. You can never be too secure.

Related Posts:

  1. what is a auth_user_file.txt?
  2. How to view PHP on live site
  3. Is moving wp-config outside the web root really beneficial?
  4. Hide the fact a site is using WordPress?
  5. Verifying that I have fully removed a WordPress hack?
  6. Best way to eliminate xmlrpc.php?
  7. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  8. Should I remove install.php and install-helper.php?
  9. Are Nonces Useless?
  10. What is the difference between esc_html filter vs attribute_escape filter?
  11. How do I technically prove that WordPress is secure?
  12. Which KSES should be used and when?
  13. How do WordPress Nonces Work?
  14. How can I easily verify a core or plugin update has not broken anything?
  15. Disable comment windows for all existing posts (pages/blogposts)
  16. Generate WordPress salt
  17. Vanilla WordPress install, what can/should I put in disable_functions?
  18. Stop wordpress automatically escaping $_POST data
  19. Secure my “add_settings_field” translation?
  20. how can i embed wordpress backend in iframe
  21. Handling nonces for actions from guests to logged-in users
  22. WordPress Logout Only If User Click Logout or If User Delete Browser History
  23. Can I force a password change?
  24. How brute-forcer knows that the password is cracked for target username?
  25. wp_insert_post disable HTML filter
  26. What is pclzip.lib.php file that wordfence think it’s a malicious code
  27. Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
  28. How to disable XML-RPC from Linux command-line in a total way?
  29. How to remove javascript malware in wordpress site [closed]
  30. Completely remove the author url
  31. Securing my WordPress Files and Directories
  32. Restricting access to content
  33. About WordPress site security
  34. Single sign-on: wp_authenticate_user vs wp_authenticate
  35. How to allow internal links using wp_kses filtration
  36. How does Cross Site Scripting (XSS) work exactly? [closed]
  37. Relative security of different releases of WordPress
  38. How does the “authentication unique keys and salts” feature work?
  39. vs WordPress Security
  40. esc_html__ security : what for in this example?
  41. Where to store OAuth 2.0 client id and secret?
  42. How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
  43. Using HTACCESS for Secret Access
  44. Definitive wordpress directory ownership and permissions on linux
  45. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  46. Changing Table Prefixes – once done, am I good to go going forward?
  47. wordpress website host price and security [closed]
  48. Are there security risks in working directly in the themes folder that builds into a theme folder?
  49. Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
  50. Secure WordPress: Change admin
  51. Changing the default header name
  52. how much information can we hide when using wordpress cms?
  53. Is it safe to use a global wp nonce per user instead of a nonce per action?
  54. Wordfence detects change in wp-admin/includes/upgrade.php
  55. Basic password protection without using users and roles
  56. System setting changed by system user
  57. Does meta-data need to be sanitized?
  58. Will there be security updates for WordPress 4.9.9
  59. Any known bugs that could cause disappearance of the wp_users table?
  60. 404/500 error on content images if Referer header is from another domain [closed]
  61. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  62. Restrict Access without Creating Users
  63. Switching between security plugins is a risk?
  64. How to obfuscate wp-config.php or code
  65. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  66. How to prevent to direct access of my custom plugin folder/files
  67. Checking for origin of a xmlrpc request
  68. RESTRICT EDIT of PHP files?
  69. wp-content – permissions for files/folders created by apache
  70. How can I restrict access to specific parts of a page, not just the page itself?
  71. User generated content and security
  72. Are major WordPress updates mandatory for security?
  73. i moved wp-config.php outside of public html and this broke my website
  74. Monitor wordpress all external calls
  75. Is it safe to use the basic administration with reduced rights for private member space
  76. Securing WordPress running on Azure platform
  77. Verifying that I have fully removed a WordPress hack?
  78. Spam Registrations
  79. How can I have more confidence that WP plugins aren’t getting and storing user data?
  80. Standard Method for Securing a WordPress Site
  81. wordpress security (only one part of the site)
  82. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  83. Any way to disable /wp-login.php redirecting to the site folder?
  84. Folder Permissions + Security Concerns
  85. Malware/Permission bug removal?
  86. Could a user account with a stolen password compromised entire WP site?
  87. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  88. Secure a WordPress website in 2019: one plugin or a combinations of them?
  89. What are the different types of firewall protections available for a WordPress website?
  90. Run a security scan on WordPress site that has .htaccess password [closed]
  91. Is this a WordPress security bug?
  92. Competitor is somehow accessing MetaData on a hidden WordPress site
  93. WordPress Hacks/Defacing [closed]
  94. Directory to store secure file
  95. How can I give someone server access to only duplicate and modify a site?
  96. How can I implement ansible with per-host passwords, securely?
  97. Why should I firewall servers?
  98. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  99. Can you alter the default wordpress strong password requirements?
  100. how to sanitizing $_POST with the correct way?