Data sanitization in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does the sanitize_text_field() function do in WordPress?

Choose the best description of what sanitize_text_field() does when processing user input.

A Converts all text to uppercase without removing any characters.

B Only trims whitespace but leaves HTML tags intact.

C Encrypts the text to store it securely in the database.

D Removes all HTML tags and encodes special characters to prevent code injection.

💡 Hint

Think about how to safely clean text inputs to avoid harmful code.

sanitize_text_field() removes HTML tags and encodes special characters to prevent malicious code from being saved or executed. It is used to clean plain text inputs.

❓ component_behavior

intermediate

What will be the output of this WordPress code snippet?

Given the following code, what will echo $cleaned; output?

Wordpress

<?php
$input = "<script>alert('hack');</script>Hello <b>World</b>!";
$cleaned = sanitize_text_field($input);
echo $cleaned;
?>

A alert('hack');Hello World!

B <script>alert('hack');</script>Hello <b>World</b>!

C Hello World!

D <script>alert('hack');</script>Hello <b>World</b>!

💡 Hint

Remember what sanitize_text_field() removes from the input.

sanitize_text_field() strips all HTML tags using wp_strip_all_tags() but retains the text content within them, resulting in 'alert('hack');Hello World!'.

📝 Syntax

advanced

Which option correctly sanitizes a URL input in WordPress?

Select the code snippet that properly sanitizes a URL stored in $url before saving.

A $safe_url = sanitize_text_field($url);

B $safe_url = htmlspecialchars($url);

C $safe_url = esc_url_raw($url);

D $safe_url = wp_strip_all_tags($url);

💡 Hint

Think about which WordPress function is designed specifically for URLs.

esc_url_raw() is the correct function to sanitize URLs before saving them. It removes invalid or dangerous characters from URLs.

🔧 Debug

advanced

Why does this WordPress code fail to sanitize user input properly?

Identify the problem in this code snippet that tries to sanitize a user-submitted email:

Wordpress

<?php
$email = $_POST['email'];
$clean_email = sanitize_email;
echo $clean_email($email);
?>

A sanitize_email should be replaced with sanitize_text_field.

B The function sanitize_email is not called correctly; it should be sanitize_email($email).

C The variable $email is not defined before sanitization.

D sanitize_email does not exist in WordPress.

💡 Hint

Check how the function is used in the code.

The code assigns the function name to a variable but does not call it properly. It should call sanitize_email($email) directly.

❓ state_output

expert

What is the value of $result after running this WordPress code?

Consider this code snippet and determine the final value of $result:

Wordpress

<?php
$input = "<a href='http://example.com'>Click</a> & <b>Bold</b>";
$step1 = wp_strip_all_tags($input);
$step2 = sanitize_text_field($step1);
$result = $step2;
?>

A Click & Bold

B Click & Bold

C Click &amp; Bold

D Click &amp; & Bold

💡 Hint

Check what each function removes or encodes.

wp_strip_all_tags() removes all HTML tags leaving 'Click & Bold'. Then sanitize_text_field() trims and cleans but does not encode the ampersand, so the result is 'Click & Bold'.

Practice

1. What is the main purpose of data sanitization functions in WordPress?

easy

A. To clean user input and prevent security issues like XSS

B. To speed up database queries

C. To format dates and times for display

D. To compress images before upload

Solution

1. Step 1: Understand data sanitization role

   Data sanitization cleans user input to remove harmful code or characters.

2. Step 2: Identify security benefits

   This prevents attacks like Cross-Site Scripting (XSS) by filtering input.

3. Final Answer:

   To clean user input and prevent security issues like XSS -> Option A

4. Quick Check:

   Data sanitization = Prevent security issues [OK]

Hint: Sanitize input to stop harmful code before saving [OK]

Common Mistakes:

• Confusing sanitization with validation
• Thinking sanitization speeds up queries
• Assuming sanitization formats output

2. Which WordPress function is used to sanitize a text field input?

easy

A. wp_kses_post()

B. esc_html()

C. sanitize_text_field()

D. sanitize_email()

Solution

1. Step 1: Identify function purpose

   sanitize_text_field() cleans plain text input by stripping tags and harmful characters.

2. Step 2: Compare other functions

   esc_html() escapes HTML for output, wp_kses_post() allows safe HTML, sanitize_email() cleans emails.

3. Final Answer:

   sanitize_text_field() -> Option C

4. Quick Check:

   Text field sanitization = sanitize_text_field() [OK]

Hint: Use sanitize_text_field() for plain text inputs [OK]

Common Mistakes:

• Using esc_html() instead of sanitize_text_field() for input
• Confusing sanitize_email() with text sanitization
• Using wp_kses_post() when no HTML is allowed

3. What will be the output of this code snippet?

 $input = "Hello";
$clean = sanitize_text_field($input);
echo $clean;

medium

A. alert('Hi');Hello

B. <script>alert('Hi');</script>Hello

C. alert('Hi');

D. Hello

Solution

1. Step 1: Understand sanitize_text_field() behavior

   This function strips HTML tags and encodes special characters, removing <script> tags.

2. Step 2: Apply to input string

   Input has a script tag and text 'Hello'. After sanitization, only 'Hello' remains.

3. Final Answer:

   Hello -> Option D

4. Quick Check:

   sanitize_text_field() removes tags = Hello [OK]

Hint: sanitize_text_field() removes all HTML tags [OK]

Common Mistakes:

• Expecting script tags to be escaped, not removed
• Confusing sanitize_text_field() with esc_html()
• Thinking output includes script content

4. Identify the error in this code snippet that sanitizes a URL input:

 $url = $_POST['website'];
$clean_url = sanitize_text_field($url);
if (filter_var($clean_url, FILTER_VALIDATE_URL)) {
  echo 'Valid URL';
} else {
  echo 'Invalid URL';
}

medium

A. sanitize_text_field() removes URL characters, causing validation to fail

B. filter_var() is not suitable for URL validation

C. $_POST['website'] should be sanitized with sanitize_email()

D. No error, code works correctly

Solution

1. Step 1: Analyze sanitize_text_field() effect on URL

   This function strips tags and encodes, which can remove or alter URL characters like ':' and '/'.

2. Step 2: Check filter_var() validation

   filter_var() expects a proper URL format, but altered URL fails validation.

3. Final Answer:

   sanitize_text_field() removes URL characters, causing validation to fail -> Option A

4. Quick Check:

   sanitize_text_field() breaks URLs = sanitize_text_field() removes URL characters, causing validation to fail [OK]

Hint: Use esc_url_raw() for URLs, not sanitize_text_field() [OK]

Common Mistakes:

• Using sanitize_text_field() for URLs
• Assuming filter_var() can't validate URLs
• Not sanitizing input before validation

5. You want to save user-submitted HTML content safely in WordPress. Which combination of functions should you use to sanitize and then safely display the content?

hard

A. Use sanitize_text_field() to sanitize and echo with wp_kses_post()

B. Use wp_kses_post() to sanitize and echo with esc_html()

C. Use wp_kses_post() to sanitize and echo directly without escaping

D. Use sanitize_email() to sanitize and echo with esc_attr()

Solution

1. Step 1: Choose sanitizer for HTML content

   wp_kses_post() allows safe HTML tags and removes harmful ones, ideal for user HTML input.

2. Step 2: Escape output for safe display

   Using esc_html() escapes HTML entities to prevent XSS when displaying content.

3. Step 3: Combine sanitization and escaping

   Sanitize input with wp_kses_post(), then escape output with esc_html() for safety.

4. Final Answer:

   Use wp_kses_post() to sanitize and echo with esc_html() -> Option B

5. Quick Check:

   Sanitize HTML input + escape output = Use wp_kses_post() to sanitize and echo with esc_html() [OK]

Hint: Sanitize HTML with wp_kses_post(), escape output with esc_html() [OK]

Common Mistakes:

• Using sanitize_text_field() which strips all HTML
• Echoing sanitized HTML without escaping
• Using sanitize_email() for HTML content