Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.
wp_verify_nonce function checks $nonce value like this:
if ( hash_equals( $expected, $nonce ) ) {
return 1;
}
For this you don’t need sanitizing. So the following is fine:
wp_verify_nonce( $_GET['some_nonce'], 'some_nonce' );
Related Posts:
- Should I sanitize an email address before passing it to the is_email() function?
- Escaping and sanitizing SVGs in metabox textarea
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- Reason for Lowercase usernames
- What is the best way to sanitize data?
- esc_url removes white space. Can I change that to using ‘-‘?
- WP Coding standards – escaping the inescapable?
- Sanitatizing when using the posts_where hook
- Escape hexadecimals/rgba values
- Must I serialize/sanitize/escape array data before using set_transient?
- Echo JavaScript Safely
- wp_kses ignore allowed and allow everything
- Sanitize array callback for the WordPress Settings API
- How to escape $_GET and check if isset?
- What’s a safe / good way to output HTML safely within WordPress templates?
- Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
- Sanitizing output that contains quotes?
- WP_Customize_Manager: How to get control ID
- How to use wp_filter_oembed_result?
- Sanitization html output itself
- Post text sanitization after publishing/editing – changes are not saved
- wp_set_object_terms() without accents
- Escaping data from database (users table) is necessary?
- Properly sanitize an input field “Name “
- What is the proper way to sanitize $_POST and $_GET vars?
- Why is sanitize_text_field() selectively trimming data?
- Custom page with variables in url. Nice url with add_rewrite_rule
- Escaping WP_Query tax_query when term has special character(s)
- Is it safe to assume that a nonce may be validated more than once?
- Can I create customizer setting that can handle plugin shortcode?
- Nonce in settings API with tabbed navigation
- Using Nonces for AJAX that only retrieves data
- How to verify nonce from Bulk/Quick Edit in save_post?
- Default WordPress settings API data sanitization
- Should I sanitize custom post meta if it is going to be escaped later?
- Reduce nonce lifespan
- How to display data from custom table in wordpress database?
- Remove tinyMCE from admin and replace with textarea
- Ajax function returns -1
- wp_verify_nonce always returns false when logged in as admin
- how to get nonce using json api
- Confusion on WP Nonce usage in my Plugin
- array_map() for sanitizing $_POST
- increase nonce lifespan
- Correct processing of `$_POST`, following WordPress Coding Standards
- why is esc_html() returning nothing given a string containing a high-bit character?
- AJAX requests broken due to HTTPS for wp-admin
- Full page NGINX (or Cloudflare) caching and WordPress nonces
- Why save_post_$(custom_post_type) is fired even if I am not already saving a post?
- Why am I getting a 403 from check_admin_referer()?
- Security checking in meta_box save is reluctant?
- How to check an ajax nonce in PHP
- Settings API – sanitize_callback is not called and it leads to an incorrect behavior
- Best Practice for Validating and Sanitizing Data
- Storing HTML in wp_options
- Help with forms and nonces
- how to send Ajax request in wordpress backend
- WP Admin AJAX Security – using POST to include a relative URL
- Modify automatically generation of slug when term is created
- Can i use the same sanitize function on multiple theme mod textboxes?
- wp_create_nonce() in REST API makes user->ID zero
- ajax nonce verification failing
- Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)
- Customizer: Category Select Sanitize
- Prevent invalid or empty values from being saved to the database and retain the form field values upon error
- Change wp_sanitize function?
- Can you have more than one nonce on a page?
- Form Security: nonce vs. jQuery
- wp_nonce_field is breaking form for reasons unknown
- Nonce doesn’t validate in nopriv call
- Trouble creating custom sanitization function for user list dropdown
- Should I use wp_nonce_field on my contact form?
- How to allow certain PHP functions when using sanitize_callback in the word press customizer
- Why does check_ajax_referer give a 403 error on https websites?
- WordPress is creating nonce as a logged in user but verifying it incorrectly
- Display the line breaks in user bio without using html
- Change user nicename without sanitize
- Where to use nonce
- How can I apply custom sanitization to new usernames?
- How do I sanitize the str_replace function in javascript variables
- Sanitizing textarea for wp_insert_post with TinyMCE enabled or disabled
- Nonce for Trashing Item
- Safely store code(html/js..) into database
- How to verify which WordPress user requested the API in ASP .NET Core?
- Reliable way to add nonce to HTTP Header in WordPress?
- wp_nonce vs jwt
- Using a nonce Content Security Policy header for style-src for inline style elements returns errors
- wp_verfy_nonce keeps giving false
- Where is the HTML-handler part in the wpdb class?
- Override plugin function to show invoices even if not logged in
- Can we validate data from jquery
- 403 Forbidden on site logo image upload
- Nonce and widget
- Is it necessary to use a WordPress nonce when allowing users to download public data?
- Custom-Metaboxes-and-Fields text_url field prepending http://
- Data validation for inline javascript
- Wp doesn’t save meta box data
- esc_url, esc_url_raw or sanitize_url?
- Nonce code vulnerability
- sanitize meta input