Data sanitization in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to sanitize a text field input in WordPress.

Wordpress

$safe_text = [1]($_POST['user_input']);

Drag options to blanks, or click blank then click option'

Asanitize_text_field

Bwp_kses_post

Cesc_html

Dsanitize_email

Attempts:

3 left

💡 Hint

Common Mistakes

Using esc_html instead of sanitize_text_field for input sanitization.

Using sanitize_email for non-email text fields.

The sanitize_text_field function cleans text input by stripping tags and removing invalid characters, making it safe for storage.

2fill in blank

medium

Complete the code to allow safe HTML tags in user input using WordPress functions.

Wordpress

$allowed_html = array('a' => array('href' => array()));
$safe_html = [1]($_POST['content'], $allowed_html);

Drag options to blanks, or click blank then click option'

Asanitize_text_field

Bwp_kses

Cesc_attr

Dsanitize_email

Attempts:

3 left

💡 Hint

Common Mistakes

Using sanitize_text_field which strips all HTML.

Using esc_attr which escapes for attributes, not sanitizing HTML.

The wp_kses function filters content to allow only specified HTML tags and attributes, preventing harmful code.

3fill in blank

hard

Fix the error in sanitizing an email input in WordPress.

Wordpress

$email = [1]($_POST['email']);

Drag options to blanks, or click blank then click option'

Awp_kses_post

Bsanitize_text_field

Cesc_html

Dsanitize_email

Attempts:

3 left

💡 Hint

Common Mistakes

Using sanitize_text_field which may allow invalid email characters.

Using esc_html which escapes output but does not sanitize input.

The sanitize_email function properly cleans email addresses by removing invalid characters.

4fill in blank

hard

Fill both blanks to sanitize and then escape a URL input safely.

Wordpress

$url = [1]($_POST['website']);
$escaped_url = [2]($url);

Drag options to blanks, or click blank then click option'

Aesc_url_raw

Bsanitize_text_field

Cesc_url

Dsanitize_email

Attempts:

3 left

💡 Hint

Common Mistakes

Escaping before sanitizing input.

Using sanitize_email for URLs.

First, esc_url_raw sanitizes the URL for storage, then esc_url escapes it for safe output in HTML.

5fill in blank

hard

Fill all three blanks to sanitize a checkbox input and safely use it in HTML.

Wordpress

$checked = isset($_POST['agree']) ? [1]($_POST['agree']) : 0;
$checked = $checked ? 1 : 0;
echo '<input type="checkbox"' . ($checked ? ' ' . [2]("checked") : '') . ' />';
$label = '[3]';

Drag options to blanks, or click blank then click option'

Aabsint

Besc_attr

CI agree to terms

Dsanitize_text_field

Attempts:

3 left

💡 Hint

Common Mistakes

Not converting checkbox input to integer.

Not escaping attribute values.

Using unsanitized label text.

Use absint to convert checkbox input to integer 0 or 1, esc_attr to escape the 'checked' attribute value, and a safe label string.