Validation of variables in WordPress

Validation of variables in WordPress is more than necessary to ensure maximum protection for your site. According to statistics, WordPress is one of the most, if not most, hacked CMS system. Of course, the main reason is that WordPress is the most popular CMS and there are basically more sites on it than on others. But also the developer is often neglected to protect their websites and their customers’ websites. Today we will talk about the four most necessary functions for variable validation.

One of the most common functions for variable validation is esc_attr (). All the variables that you display in the templates must be cleared with this function:

[php]
$text = ‘some text’;
echo esc_attr( $text );
[/php]

To validate url use esc_url ():

[php]
$url = ‘https://an2-studio.xyz’;
echo esc_url( $url );
[/php]

To safely work with databases, you need to validate the variable with esc_sql ():

[php]
$option = esc_sql( $key );
$wpdb->get_var( "SELECT meta_value FROM table WHERE meta_key = ‘$option’";
[/php]

esc_html () replaces html tags and returns formatted text, often used to output text in a template:

[php]
echo esc_html(‘Some text’, ‘text_domain’);
[/php]

Do not forget to use the above functions to make your site as secure as possible.

P.S. This is especially important if you create themes or plugins for ThemeForest or CodeCanyon.