No the sanitization is already done. Well the mysql_real_escape_string is done, it’s considered bad form to filter html on input. I personally think doing it on output kinda breaches DRY. If you did in WordPress I highly suspect somewhere else will do it again resulting in double html entities encoding.
Also by the way, wpdb::insert is basically just a wrapper for wpdb::prepare.
Related Posts:
- Should I sanitize an email address before passing it to the is_email() function?
- Escaping and sanitizing SVGs in metabox textarea
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- Reason for Lowercase usernames
- Should nonce be sanitized?
- esc_url removes white space. Can I change that to using ‘-‘?
- WP Coding standards – escaping the inescapable?
- Sanitatizing when using the posts_where hook
- Escape hexadecimals/rgba values
- Must I serialize/sanitize/escape array data before using set_transient?
- How to save html and text in the database?
- Echo JavaScript Safely
- wpdb get_results() and prepare when to use prepare?
- wp_kses ignore allowed and allow everything
- Sanitize array callback for the WordPress Settings API
- sanitize_text_field and apostrophe problem
- How to escape $_GET and check if isset?
- What’s a safe / good way to output HTML safely within WordPress templates?
- Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
- Sanitizing output that contains quotes?
- WP_Customize_Manager: How to get control ID
- How to use wp_filter_oembed_result?
- Where is the HTML-handler part in the wpdb class?
- Sanitization html output itself
- Post text sanitization after publishing/editing – changes are not saved
- wp_set_object_terms() without accents
- Escaping data from database (users table) is necessary?
- Properly sanitize an input field “Name “
- Sanitize a custom date meta field
- What is the proper way to sanitize $_POST and $_GET vars?
- Why is sanitize_text_field() selectively trimming data?
- what is a good method to sanitize the whole $_POST array in php?
- Using wpdb to connect to a separate database
- How do you properly prepare a %LIKE% SQL statement?
- How to print the excuted sql right after its execution
- $wpdb->get_row() only returns a single row?
- Should I use wpdb prepare?
- WPDB Insert or if exists Update
- Query to sort a list by meta key first (if it exists), and show remaining posts without meta key ordered by title
- Showing errors with $wpdb update
- Is sanitize_title enough to generate post slugs?
- How to return number of found rows from SELECT query
- Is it mandatory to use $wpdb->prefix in custom tables
- wpdb->insert: do I need to prepare against SQL injection?
- get_results using wpdb
- In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
- How to programatically change username (user_login)?
- wordpress sanitize array?
- Data sanitization: Best Practices with code examples
- $wpdb won’t insert NULL into table column
- How to parse row results from $wpdb -> get_results
- How safe / sanitized is wp_insert_posts()?
- Should HTML output be passed through esc_html() AND wp_kses()?
- Why $wpdb->show_errors() and print_error() is showing an output even if the query output is correct?
- what is the way to see the currently executing query in wordpress?
- When to use esc_html and when to use sanitize_text_field?
- Fetch array with $wpdb
- How do I check for a duplicate record before inserting using wpdb
- Pagination with custom SQL query
- Get error messages when $wpdb->insert() returns false?
- Return only Count from a wp_query request?
- Detecting errors generated by $wpdb->get_results()
- Does dbDelta delete columns as well?
- WordPress 4.8.1 uses mysql_connect which doesn’t work with PHP 7
- wpdb update add current timestamp not working
- How to safely sanitize a textarea which takes full HTML input
- How to fetch Data in WordPress using MySQLi or $wpdb
- How to use $wpdb to delete in a custom table
- Sanitize and data validation with apply_filters() function
- $wpdb->insert not working in any way
- WPDB prepare – like % – placeholders?
- How to delete all records from or empty a custom database table?
- dbDelta only creates the last table
- Custom page with variables in url. Nice url with add_rewrite_rule
- WordPress Paginate $wpdb->get_results
- wpdb->insert multiple record at once
- Sanitize content from wp_editor
- Differences between wpdb->get_results() and wpdb->query()
- How to properly validate data from $_GET or $_REQUEST using WordPress functions?
- What’s the difference between esc_* functions?
- $wpdb->insert_id
- Can i use php sql functions instead of $wpdb?
- Does a query executed through wpdb class get cached?
- is_email() VS sanitize_email()
- $wpdb->update multiple rows, like IN in normal SQL
- Sanitizing integer input for update_post_meta
- What are the differences between wp_users and wp_usermeta tables?
- Sanitize User Entered CSS
- Matching database content types to PHP types
- $wpdb->get_results(…) returns empty array despite correct query
- Which KSES should be used and when?
- Does $wpdb->prepare not create a prepared statement that I can execute multiple times?
- WordPress Unit Testing – Cannot Create Tables
- Use wpdb->prepare for `order by` column name
- How to define composite keys with dbDelta()
- get_results on large datasets
- Is sanitize_text_field() is enough to save to DB?
- Does wpdb add considerable overhead on queries with large result sets?
- $wpdb->insert() and Values for Datetime Columns?
- Settings API – sanitizing urls, email addresses and text