In my plugin people can add placeholders that are substituted later in the workflow.

A typical placeholder might look like %name%, %address% %postal_code%

However in the database sanitize_text_field saves it as %name%, dress% %postal_code% - it strips the leading % from only one instance. I can workaround it by using esc_html, but am curious about what is going on here.

Can anyone explain it?

In my plugin people can add placeholders that are substituted later in the workflow.

A typical placeholder might look like %name%, %address% %postal_code%

However in the database sanitize_text_field saves it as %name%, dress% %postal_code% - it strips the leading % from only one instance. I can workaround it by using esc_html, but am curious about what is going on here.

Can anyone explain it?

• sanitization

• I would note that while this is tagged as escaping, that function is a sanitising function not an escaping function, and should never be used to escape. Sanitising and escaping are two very different things. Likewise you should not be using esc_html to sanitise data on its way into the database, esc_html is an escaping function not a sanitising function – Tom J Nowell ♦ Commented Feb 15 at 23:38
• Thanks, I couldn't spot the right tag, and had to use one, that caught my eye :P – Steve Commented Feb 16 at 0:16

1 Answer 1

Can anyone explain it?

The official docs for that function say it strips percent encoded characters.

• Checks for invalid UTF-8,
• Converts single < characters to entities
• Strips all tags
• Removes line breaks, tabs, and extra whitespace
• Strips percent-encoded characters

https://developer.wordpress/reference/functions/sanitize_text_field/

It looks like it's stripped out %ad and it has nothing to do with instances or leading/trailing, that function doesn't understand that it's a CSV etc, % probably isn't the best character to use for this.

Why just the %ad though? In this case it's the URL encoded value for ­ aka a soft hyphen, or ­.

See https://www.w3schools/tags//ref_urlencode.asp for a more comprehensive table.