Section on escaping and sanitization functions

WordPress / Security-White-Paper

The WordPress Security White Paper, available directly on the WordPress.org site at https://wordpress.org/about/security/

96 stars 53 forks source link

Section on escaping and sanitization functions #58

Open johnbillion opened 7 years ago

johnbillion commented 7 years ago

There should be a section covering the escaping and sanitization functions that core provides for theme and plugin authors. Even if they're not covered in technical detail, their existence is an important part of the security of WordPress.

Escaping

esc_html()
esc_attr()
esc_url()
esc_textarea()
esc_js()

Sanitization

esc_url_raw()
sanitize_key()
sanitize_text_field()
sanitize_textarea_field() ...and probably others.

desrosj commented 1 year ago

@johnbillion Do you still feel this belongs here? This seems like something that's better suited for plugin/theme/core developer resource pages, which covers these topics pretty comprehensively.

Sanitizing input (plugins)
Securing output (plugins)
Data Sanitization/Escaping (themes)
WordPress/WordPress-Coding-Standards

These pages are fairly well maintained and updated as new functions are introduced/old ones are modified. Maybe we just link out to these resources with a brief summary?

johnbillion commented 1 year ago

Yeah let's link out to them instead