rest_parse_request_arg

[pissio]

rest_parse_request_arg( $value, $request, $param )

function performs twice rest_validate_request_arg.
Both times returns the returned value, whether it is an error or valid value.

Why not simply return rest_sanitize_request_arg value the first time?

[swissspidy]

Hey there

The first function being called is rest_validate_request_arg(), the second rest_sanitize_request_arg(). Both do different things.

[SergeyBiryukov]

Hi @pissio, welcome to WordPress Core Trac!

As noted above, rest_validate_request_arg() is not the same as rest_sanitize_request_arg(). The former checks if the argument matches the requirements, the latter cleans it to remove potential malicious data.

This Codex article might be helpful to better understand the difference between validation and sanitization:
​https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data