sanitize_option

Sanitises various option values based on the nature of the option.

Description

(string) sanitize_option( (string) $option, (string) $value ); 

This is basically a switch statement which will pass $value through a number of functions depending on the $option.

Returns (string)

Sanitized value.

Parameters (2)

0. $option (string)
The name of the option.
1. $value (string)
The unsanitised value.

Usage

  1. if ( !function_exists( 'sanitize_option' ) ) { 
  2.     require_once ABSPATH . WPINC . '/formatting.php'; 
  3. } 
  4.   
  5. // The name of the option. 
  6. $option = ''; 
  7.   
  8. // The unsanitised value. 
  9. $value = ''; 
  10.   
  11. // NOTICE! Understand what this does before running. 
  12. $result = sanitize_option($option, $value); 
  13.     

Defined (1)

The function is defined in the following location(s).

/wp-includes/formatting.php  
  1. function sanitize_option( $option, $value ) { 
  2.     global $wpdb; 
  3.  
  4.     $original_value = $value; 
  5.     $error = ''; 
  6.  
  7.     switch ( $option ) { 
  8.         case 'admin_email' : 
  9.         case 'new_admin_email' : 
  10.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  11.             if ( is_wp_error( $value ) ) { 
  12.                 $error = $value->get_error_message(); 
  13.             } else { 
  14.                 $value = sanitize_email( $value ); 
  15.                 if ( ! is_email( $value ) ) { 
  16.                     $error = __( 'The email address entered did not appear to be a valid email address. Please enter a valid email address.' ); 
  17.                 } 
  18.             } 
  19.             break; 
  20.  
  21.         case 'thumbnail_size_w': 
  22.         case 'thumbnail_size_h': 
  23.         case 'medium_size_w': 
  24.         case 'medium_size_h': 
  25.         case 'medium_large_size_w': 
  26.         case 'medium_large_size_h': 
  27.         case 'large_size_w': 
  28.         case 'large_size_h': 
  29.         case 'mailserver_port': 
  30.         case 'comment_max_links': 
  31.         case 'page_on_front': 
  32.         case 'page_for_posts': 
  33.         case 'rss_excerpt_length': 
  34.         case 'default_category': 
  35.         case 'default_email_category': 
  36.         case 'default_link_category': 
  37.         case 'close_comments_days_old': 
  38.         case 'comments_per_page': 
  39.         case 'thread_comments_depth': 
  40.         case 'users_can_register': 
  41.         case 'start_of_week': 
  42.         case 'site_icon': 
  43.             $value = absint( $value ); 
  44.             break; 
  45.  
  46.         case 'posts_per_page': 
  47.         case 'posts_per_rss': 
  48.             $value = (int) $value; 
  49.             if ( empty($value) ) 
  50.                 $value = 1; 
  51.             if ( $value < -1 ) 
  52.                 $value = abs($value); 
  53.             break; 
  54.  
  55.         case 'default_ping_status': 
  56.         case 'default_comment_status': 
  57.             // Options that if not there have 0 value but need to be something like "closed" 
  58.             if ( $value == '0' || $value == '') 
  59.                 $value = 'closed'; 
  60.             break; 
  61.  
  62.         case 'blogdescription': 
  63.         case 'blogname': 
  64.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  65.             if ( $value !== $original_value ) { 
  66.                 $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', wp_encode_emoji( $original_value ) ); 
  67.             } 
  68.  
  69.             if ( is_wp_error( $value ) ) { 
  70.                 $error = $value->get_error_message(); 
  71.             } else { 
  72.                 $value = esc_html( $value ); 
  73.             } 
  74.             break; 
  75.  
  76.         case 'blog_charset': 
  77.             $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value); // strips slashes 
  78.             break; 
  79.  
  80.         case 'blog_public': 
  81.             // This is the value if the settings checkbox is not checked on POST. Don't rely on this. 
  82.             if ( null === $value ) 
  83.                 $value = 1; 
  84.             else 
  85.                 $value = intval( $value ); 
  86.             break; 
  87.  
  88.         case 'date_format': 
  89.         case 'time_format': 
  90.         case 'mailserver_url': 
  91.         case 'mailserver_login': 
  92.         case 'mailserver_pass': 
  93.         case 'upload_path': 
  94.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  95.             if ( is_wp_error( $value ) ) { 
  96.                 $error = $value->get_error_message(); 
  97.             } else { 
  98.                 $value = strip_tags( $value ); 
  99.                 $value = wp_kses_data( $value ); 
  100.             } 
  101.             break; 
  102.  
  103.         case 'ping_sites': 
  104.             $value = explode( "\n", $value ); 
  105.             $value = array_filter( array_map( 'trim', $value ) ); 
  106.             $value = array_filter( array_map( 'esc_url_raw', $value ) ); 
  107.             $value = implode( "\n", $value ); 
  108.             break; 
  109.  
  110.         case 'gmt_offset': 
  111.             $value = preg_replace('/[^0-9:.-]/', '', $value); // strips slashes 
  112.             break; 
  113.  
  114.         case 'siteurl': 
  115.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  116.             if ( is_wp_error( $value ) ) { 
  117.                 $error = $value->get_error_message(); 
  118.             } else { 
  119.                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) { 
  120.                     $value = esc_url_raw( $value ); 
  121.                 } else { 
  122.                     $error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' ); 
  123.                 } 
  124.             } 
  125.             break; 
  126.  
  127.         case 'home': 
  128.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  129.             if ( is_wp_error( $value ) ) { 
  130.                 $error = $value->get_error_message(); 
  131.             } else { 
  132.                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) { 
  133.                     $value = esc_url_raw( $value ); 
  134.                 } else { 
  135.                     $error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' ); 
  136.                 } 
  137.             } 
  138.             break; 
  139.  
  140.         case 'WPLANG': 
  141.             $allowed = get_available_languages(); 
  142.             if ( ! is_multisite() && defined( 'WPLANG' ) && '' !== WPLANG && 'en_US' !== WPLANG ) { 
  143.                 $allowed[] = WPLANG; 
  144.             } 
  145.             if ( ! in_array( $value, $allowed ) && ! empty( $value ) ) { 
  146.                 $value = get_option( $option ); 
  147.             } 
  148.             break; 
  149.  
  150.         case 'illegal_names': 
  151.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  152.             if ( is_wp_error( $value ) ) { 
  153.                 $error = $value->get_error_message(); 
  154.             } else { 
  155.                 if ( ! is_array( $value ) ) 
  156.                     $value = explode( ' ', $value ); 
  157.  
  158.                 $value = array_values( array_filter( array_map( 'trim', $value ) ) ); 
  159.  
  160.                 if ( ! $value ) 
  161.                     $value = ''; 
  162.             } 
  163.             break; 
  164.  
  165.         case 'limited_email_domains': 
  166.         case 'banned_email_domains': 
  167.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  168.             if ( is_wp_error( $value ) ) { 
  169.                 $error = $value->get_error_message(); 
  170.             } else { 
  171.                 if ( ! is_array( $value ) ) 
  172.                     $value = explode( "\n", $value ); 
  173.  
  174.                 $domains = array_values( array_filter( array_map( 'trim', $value ) ) ); 
  175.                 $value = array(); 
  176.  
  177.                 foreach ( $domains as $domain ) { 
  178.                     if ( ! preg_match( '/(--|\.\.)/', $domain ) && preg_match( '|^([a-zA-Z0-9-\.])+$|', $domain ) ) { 
  179.                         $value[] = $domain; 
  180.                     } 
  181.                 } 
  182.                 if ( ! $value ) 
  183.                     $value = ''; 
  184.             } 
  185.             break; 
  186.  
  187.         case 'timezone_string': 
  188.             $allowed_zones = timezone_identifiers_list(); 
  189.             if ( ! in_array( $value, $allowed_zones ) && ! empty( $value ) ) { 
  190.                 $error = __( 'The timezone you have entered is not valid. Please select a valid timezone.' ); 
  191.             } 
  192.             break; 
  193.  
  194.         case 'permalink_structure': 
  195.         case 'category_base': 
  196.         case 'tag_base': 
  197.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  198.             if ( is_wp_error( $value ) ) { 
  199.                 $error = $value->get_error_message(); 
  200.             } else { 
  201.                 $value = esc_url_raw( $value ); 
  202.                 $value = str_replace( 'http://', '', $value ); 
  203.             } 
  204.  
  205.             if ( 'permalink_structure' === $option && '' !== $value && ! preg_match( '/%[^\/%]+%/', $value ) ) { 
  206.                 $error = sprintf( 
  207.                     /** translators: %s: Codex URL */ 
  208.                     __( 'A structure tag is required when using custom permalinks. <a href="%s">Learn more</a>' ),  
  209.                     __( 'https://codex.wordpress.org/Using_Permalinks#Choosing_your_permalink_structure' ) 
  210.  ); 
  211.             } 
  212.             break; 
  213.  
  214.         case 'default_role' : 
  215.             if ( ! get_role( $value ) && get_role( 'subscriber' ) ) 
  216.                 $value = 'subscriber'; 
  217.             break; 
  218.  
  219.         case 'moderation_keys': 
  220.         case 'blacklist_keys': 
  221.             $value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value ); 
  222.             if ( is_wp_error( $value ) ) { 
  223.                 $error = $value->get_error_message(); 
  224.             } else { 
  225.                 $value = explode( "\n", $value ); 
  226.                 $value = array_filter( array_map( 'trim', $value ) ); 
  227.                 $value = array_unique( $value ); 
  228.                 $value = implode( "\n", $value ); 
  229.             } 
  230.             break; 
  231.     } 
  232.  
  233.     if ( ! empty( $error ) ) { 
  234.         $value = get_option( $option ); 
  235.         if ( function_exists( 'add_settings_error' ) ) { 
  236.             add_settings_error( $option, "invalid_{$option}", $error ); 
  237.         } 
  238.     } 
  239.  
  240.     /** 
  241.      * Filters an option value following sanitization. 
  242.      * 
  243.      * @since 2.3.0 
  244.      * @since 4.3.0 Added the `$original_value` parameter. 
  245.      * 
  246.      * @param string $value          The sanitized option value. 
  247.      * @param string $option         The option name. 
  248.      * @param string $original_value The original value passed to the function. 
  249.      */ 
  250.     return apply_filters( "sanitize_option_{$option}", $value, $option, $original_value ); 
  251. }