Data sanitization in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does the sanitize_text_field() function do in WordPress?

Choose the best description of what sanitize_text_field() does when processing user input.

A Converts all text to uppercase without removing any characters.

B Only trims whitespace but leaves HTML tags intact.

C Encrypts the text to store it securely in the database.

D Removes all HTML tags and encodes special characters to prevent code injection.

💡 Hint

Think about how to safely clean text inputs to avoid harmful code.

sanitize_text_field() removes HTML tags and encodes special characters to prevent malicious code from being saved or executed. It is used to clean plain text inputs.

❓ component_behavior

intermediate

What will be the output of this WordPress code snippet?

Given the following code, what will echo $cleaned; output?

Wordpress

<?php
$input = "<script>alert('hack');</script>Hello <b>World</b>!";
$cleaned = sanitize_text_field($input);
echo $cleaned;
?>

A alert('hack');Hello World!

B <script>alert('hack');</script>Hello <b>World</b>!

C Hello World!

D <script>alert('hack');</script>Hello <b>World</b>!

💡 Hint

Remember what sanitize_text_field() removes from the input.

sanitize_text_field() strips all HTML tags using wp_strip_all_tags() but retains the text content within them, resulting in 'alert('hack');Hello World!'.

📝 Syntax

advanced

Which option correctly sanitizes a URL input in WordPress?

Select the code snippet that properly sanitizes a URL stored in $url before saving.

A $safe_url = sanitize_text_field($url);

B $safe_url = htmlspecialchars($url);

C $safe_url = esc_url_raw($url);

D $safe_url = wp_strip_all_tags($url);

💡 Hint

Think about which WordPress function is designed specifically for URLs.

esc_url_raw() is the correct function to sanitize URLs before saving them. It removes invalid or dangerous characters from URLs.

🔧 Debug

advanced

Why does this WordPress code fail to sanitize user input properly?

Identify the problem in this code snippet that tries to sanitize a user-submitted email:

Wordpress

<?php
$email = $_POST['email'];
$clean_email = sanitize_email;
echo $clean_email($email);
?>

A sanitize_email should be replaced with sanitize_text_field.

B The function sanitize_email is not called correctly; it should be sanitize_email($email).

C The variable $email is not defined before sanitization.

D sanitize_email does not exist in WordPress.

💡 Hint

Check how the function is used in the code.

The code assigns the function name to a variable but does not call it properly. It should call sanitize_email($email) directly.

❓ state_output

expert

What is the value of $result after running this WordPress code?

Consider this code snippet and determine the final value of $result:

Wordpress

<?php
$input = "<a href='http://example.com'>Click</a> & <b>Bold</b>";
$step1 = wp_strip_all_tags($input);
$step2 = sanitize_text_field($step1);
$result = $step2;
?>

A Click & Bold

B Click & Bold

C Click &amp; Bold

D Click &amp; & Bold

💡 Hint

Check what each function removes or encodes.

wp_strip_all_tags() removes all HTML tags leaving 'Click & Bold'. Then sanitize_text_field() trims and cleans but does not encode the ampersand, so the result is 'Click & Bold'.