I wanted to sanitize a WP_Query post object without using foreach.

I used this method:

$args = array(
// ...
)
$data = array();

$the_query = new WP_Query($args);

$data["post"] = $the_query->posts;

array_map("sanitize_post", $data["post"]);

return rest_ensure_response($data);

output:

as you can see that filter is working and its turning to "Display" from "Raw".

But the problem is: <script> tags still standing in post_title field.

Whats the problem?

I wanted to sanitize a WP_Query post object without using foreach.

I used this method:

$args = array(
// ...
)
$data = array();

$the_query = new WP_Query($args);

$data["post"] = $the_query->posts;

array_map("sanitize_post", $data["post"]);

return rest_ensure_response($data);

output:

as you can see that filter is working and its turning to "Display" from "Raw".

But the problem is: <script> tags still standing in post_title field.

Whats the problem?

• wp-query
• security
• array

• 1 I don't see anything in the docs that suggests that sanitize_post is supposed to remove script tags. – Jacob Peattie Commented Feb 21, 2021 at 14:47
• Thank you for your fast response. Then why we have this function? Main reason behind sanitizing is XSS in my opinion. – techn9ne Commented Feb 21, 2021 at 14:51
• I guess I figured it out. I'm editing my question. – techn9ne Commented Feb 21, 2021 at 14:54
• Escaping is for preventing XSS. – Jacob Peattie Commented Feb 21, 2021 at 14:57
• 1 You're meant to use the sanitisation argument for sanitising: developer.wordpress/rest-api/extending-the-rest-api/…, and you should use the official REST API endpoint that show_in_rest adds, and use pre_get_posts to make any adjustments to what it displays to the user. – Tom J Nowell ♦ Commented Feb 21, 2021 at 15:53

1 Answer 1

Solution:

sanitize_post is coming with "display" default filter option. And it does not sanitize tags.

But if you tries a code like this:

 $sanitizer = function($post){
 return sanitize_post($post, "db"); // or "edit"
};

array_map($sanitizer, $data["post"]);

Now it sanitizes fields against XSS!