Sanitize Wordpress Metabox Fields (POST array) - The right way - php

Question

I´m working on a wordpress plugin with Metaboxes. The plugin got rejected because of the Sanitize of metabox fields.
My save_fields function
public function save_fields( $post_id ) {
if ( ! isset( $_POST['modalsettings_nonce'] ) )
return $post_id;
$nonce = $_POST['modalsettings_nonce'];
if ( !wp_verify_nonce( $nonce, 'modalsettings_data' ) )
return $post_id;
if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
return $post_id;
foreach ( $this->meta_fields as $meta_field ) {
$userInput = $_POST[ $meta_field['id'] ];
if ( isset( $userInput ) ) {
switch ( $meta_field['type'] ) {
case 'email':
$userInput = sanitize_email( $_POST[ $meta_field['id'] ] );
break;
case 'text':
$userInput = sanitize_text_field( $_POST[ $meta_field['id'] ] );
break;
}
update_post_meta( $post_id, $meta_field['id'], $userInput );
} else if ( $meta_field['type'] === 'checkbox' ) {
update_post_meta( $post_id, $meta_field['id'], '0' );
}
}
}
The comment from wordpress review team
Data Must be Sanitized, Escaped, and Validated
When you include POST/GET/REQUEST/FILE calls in your plugin, it's
important to sanitize, validate, and escape them. The goal here is to
prevent a user from accidentally sending trash data through the
system, as well as protecting them from potential security issues.
SANITIZE: Data that is input (either by a user or automatically) must
be sanitized as soon as possible. This lessens the possibility of XSS
vulnerabilities and MITM attacks where posted data is subverted.
VALIDATE: All data should be validated, no matter what. Even when you
sanitize, remember that you don’t want someone putting in ‘dog’ when
the only valid values are numbers.
ESCAPE: Data that is output must be escaped properly when it is
echo'd, so it can't hijack admin screens. There are many esc_*()
functions you can use to make sure you don't show people the wrong
data.
To help you with this, WordPress comes with a number of sanitization
and escaping functions. You can read about those here:
https://developer.wordpress.org/plugins/security/securing-input/
https://developer.wordpress.org/plugins/security/securing-output/
Remember: You must use the most appropriate functions for the context.
If you’re sanitizing email, use sanitize_email(), if you’re outputting
HTML, use esc_html(), and so on.
An easy mantra here is this:
Sanitize early Escape Late Always Validate
Clean everything, check everything, escape everything, and never trust
the users to always have input sane data. After all, users come from
all walks of life.
Example(s) from your plugin:
stylistic-modals/admin/metaboxes.php:202: $userInput = $_POST[
$meta_field['id'] ]; if ( isset( $userInput ) ) { switch (
$meta_field['type'] ) { case 'email': $userInput = sanitize_email(
$_POST[ $meta_field['id'] ] ); break; case 'text': $userInput =
sanitize_text_field( $_POST[ $meta_field['id'] ] ); break; }
update_post_meta( $post_id, $meta_field['id'], $userInput );
Because you save $userInput later down, you must sanitize it.
What can I do?
I have no more ideas what Wordpress want from me and when should I sanitize the fields...also if I search for examples I find just this way to sanitize $_POST arrays....
Do you have any idea?
Edit: Will this work?
public function save_fields( $post_id ) {
if ( ! isset( $_POST['modalsettings_nonce'] ) )
return $post_id;
$nonce = $_POST['modalsettings_nonce'];
if ( !wp_verify_nonce( $nonce, 'modalsettings_data' ) )
return $post_id;
if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )
return $post_id;
foreach ( $this->meta_fields as $meta_field ) {
if ( isset( $_POST[ $meta_field['id'] ] ) ) {
$sanitizedUserInput = "";
$sanitizedMetaFieldID = "";
switch ( $meta_field['type'] ) {
case 'email':
$sanitizedUserInput = sanitize_email( $_POST[ $meta_field['id'] ] );
$sanitizedMetaFieldID = sanitize_email( $meta_field['id']);
break;
case 'text':
$sanitizedUserInput = sanitize_text_field( $_POST[ $meta_field['id'] ] );
$sanitizedMetaFieldID = sanitize_text_field( $meta_field['id']);
break;
default:
$sanitizedUserInput = sanitize_text_field( $_POST[ $meta_field['id'] ] );
$sanitizedMetaFieldID = sanitize_text_field( $meta_field['id']);
}
update_post_meta( $post_id, $sanitizedMetaFieldID, $sanitizedUserInput );
} else if ( $meta_field['type'] === 'checkbox' ) {
$sanitizedMetaFieldID = sanitize_text_field( $meta_field['id']);
update_post_meta( $post_id, $sanitizedMetaFieldID, '0' );
}
}
}

Answer 1

Well, you have this assigning $userInput = $_POST[ $meta_field['id'] ]; there before the if statement. Then you've a switch statement. Now, say, on some reasons, the php execution flow doesn't access to switch statement.
Next up, the php execution flow reaches here:
update_post_meta( $post_id, $meta_field['id'], $userInput );
That means the $userInput variable is NOT being then sanitized. This may be the reason. I hope this would help you.