sanitize_post_field

Sanitize post field based on context.

Description

sanitize_post_field( (string) $field, (mixed) $value, (int) $post_id, (string) $context = 'display' ); 

Possible context values are: raw,, edit , db, display, attribute and js. The display context is used by default. attribute and js contexts are treated like display when calling filters.

Parameters (4)

0. $field (string)
The Post Object field name.
1. $value (mixed)
The Post Object value.
2. $post_id (int)
The post id.
3. $context — Optional. (string) => 'display'
How to sanitize post fields. Looks for raw,, edit , db., display, attribute and js. Default display.

Usage

  1. if ( !function_exists( 'sanitize_post_field' ) ) { 
  2.     require_once ABSPATH . WPINC . '/post.php'; 
  3. } 
  4.   
  5. // The Post Object field name. 
  6. $field = ''; 
  7.   
  8. // The Post Object value. 
  9. $value = null; 
  10.   
  11. // The post id. 
  12. $post_id = -1; 
  13.   
  14. // Optional. How to sanitize post fields. Looks for 'raw', 'edit', 
  15. // 'db', 'display', 'attribute' and 'js'. Default 'display'. 
  16. $context = 'display'; 
  17.   
  18. // NOTICE! Understand what this does before running. 
  19. $result = sanitize_post_field($field, $value, $post_id, $context); 
  20.     

Defined (1)

The function is defined in the following location(s).

/wp-includes/post.php  
  1. function sanitize_post_field( $field, $value, $post_id, $context = 'display' ) { 
  2.     $int_fields = array('ID', 'post_parent', 'menu_order'); 
  3.     if ( in_array($field, $int_fields) ) 
  4.         $value = (int) $value; 
  5.  
  6.     // Fields which contain arrays of integers. 
  7.     $array_int_fields = array( 'ancestors' ); 
  8.     if ( in_array($field, $array_int_fields) ) { 
  9.         $value = array_map( 'absint', $value); 
  10.         return $value; 
  11.     } 
  12.  
  13.     if ( 'raw' == $context ) 
  14.         return $value; 
  15.  
  16.     $prefixed = false; 
  17.     if ( false !== strpos($field, 'post_') ) { 
  18.         $prefixed = true; 
  19.         $field_no_prefix = str_replace('post_', '', $field); 
  20.     } 
  21.  
  22.     if ( 'edit' == $context ) { 
  23.         $format_to_edit = array('post_content', 'post_excerpt', 'post_title', 'post_password'); 
  24.  
  25.         if ( $prefixed ) { 
  26.  
  27.             /** 
  28.              * Filters the value of a specific post field to edit. 
  29.              * 
  30.              * The dynamic portion of the hook name, `$field`, refers to the post 
  31.              * field name. 
  32.              * 
  33.              * @since 2.3.0 
  34.              * 
  35.              * @param mixed $value   Value of the post field. 
  36.              * @param int   $post_id Post ID. 
  37.              */ 
  38.             $value = apply_filters( "edit_{$field}", $value, $post_id ); 
  39.  
  40.             /** 
  41.              * Filters the value of a specific post field to edit. 
  42.              * 
  43.              * The dynamic portion of the hook name, `$field_no_prefix`, refers to 
  44.              * the post field name. 
  45.              * 
  46.              * @since 2.3.0 
  47.              * 
  48.              * @param mixed $value   Value of the post field. 
  49.              * @param int   $post_id Post ID. 
  50.              */ 
  51.             $value = apply_filters( "{$field_no_prefix}_edit_pre", $value, $post_id ); 
  52.         } else { 
  53.             $value = apply_filters( "edit_post_{$field}", $value, $post_id ); 
  54.         } 
  55.  
  56.         if ( in_array($field, $format_to_edit) ) { 
  57.             if ( 'post_content' == $field ) 
  58.                 $value = format_to_edit($value, user_can_richedit()); 
  59.             else 
  60.                 $value = format_to_edit($value); 
  61.         } else { 
  62.             $value = esc_attr($value); 
  63.         } 
  64.     } elseif ( 'db' == $context ) { 
  65.         if ( $prefixed ) { 
  66.  
  67.             /** 
  68.              * Filters the value of a specific post field before saving. 
  69.              * 
  70.              * The dynamic portion of the hook name, `$field`, refers to the post 
  71.              * field name. 
  72.              * 
  73.              * @since 2.3.0 
  74.              * 
  75.              * @param mixed $value Value of the post field. 
  76.              */ 
  77.             $value = apply_filters( "pre_{$field}", $value ); 
  78.  
  79.             /** 
  80.              * Filters the value of a specific field before saving. 
  81.              * 
  82.              * The dynamic portion of the hook name, `$field_no_prefix`, refers 
  83.              * to the post field name. 
  84.              * 
  85.              * @since 2.3.0 
  86.              * 
  87.              * @param mixed $value Value of the post field. 
  88.              */ 
  89.             $value = apply_filters( "{$field_no_prefix}_save_pre", $value ); 
  90.         } else { 
  91.             $value = apply_filters( "pre_post_{$field}", $value ); 
  92.  
  93.             /** 
  94.              * Filters the value of a specific post field before saving. 
  95.              * 
  96.              * The dynamic portion of the hook name, `$field`, refers to the post 
  97.              * field name. 
  98.              * 
  99.              * @since 2.3.0 
  100.              * 
  101.              * @param mixed $value Value of the post field. 
  102.              */ 
  103.             $value = apply_filters( "{$field}_pre", $value ); 
  104.         } 
  105.     } else { 
  106.  
  107.         // Use display filters by default. 
  108.         if ( $prefixed ) { 
  109.  
  110.             /** 
  111.              * Filters the value of a specific post field for display. 
  112.              * 
  113.              * The dynamic portion of the hook name, `$field`, refers to the post 
  114.              * field name. 
  115.              * 
  116.              * @since 2.3.0 
  117.              * 
  118.              * @param mixed  $value   Value of the prefixed post field. 
  119.              * @param int    $post_id Post ID. 
  120.              * @param string $context Context for how to sanitize the field. Possible 
  121.              *                        values include 'raw', 'edit', 'db', 'display',  
  122.              *                        'attribute' and 'js'. 
  123.              */ 
  124.             $value = apply_filters( $field, $value, $post_id, $context ); 
  125.         } else { 
  126.             $value = apply_filters( "post_{$field}", $value, $post_id, $context ); 
  127.         } 
  128.  
  129.         if ( 'attribute' == $context ) { 
  130.             $value = esc_attr( $value ); 
  131.         } elseif ( 'js' == $context ) { 
  132.             $value = esc_js( $value ); 
  133.         } 
  134.     } 
  135.  
  136.     return $value; 
  137. }