Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#59961 closed enhancement (duplicate)

Replace `sanitize_text_field` with `sanitize_email`

Reported by: hellosatya Owned by:
Priority: normal Milestone:
Component: Users Version:
Severity: normal Keywords:
Cc: Focuses:

Description

Patch - ​https://github.com/WordPress/wordpress-develop/compare/trunk...askhellosatya:wordpress-develop:patch-1

The current code segment, last updated 9 years ago by @boone, utilizes sanitize_text_field to handle email input:

if ( isset( $_POST['email'] ) ) {
    $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
}

For enhanced security and precision, it's recommended to update it as follows, utilizing sanitize_email specifically for email inputs:

if ( isset( $_POST['email'] ) ) {
    $user->user_email = sanitize_email( wp_unslash( $_POST['email'] ) );
}

This change ensures the proper sanitization of the email input, promoting better code practices and improved data handling.

Change History (2)

#1 @hellosatya
3 years ago

  • Summary Enhancement Suggestion for Code Improvement - Patch is attached. → Replace `sanitize_text_field` with `sanitize_email`

#2 @sabernhardt
3 years ago

  • Focuses coding-standards php-compatibility removed
  • Keywords needs-refresh has-patch removed
  • Milestone Awaiting Review
  • Resolution → duplicate
  • Status new → closed
  • Version trunk

Hi and welcome to WordPress Core Trac!

The sanitize_email() function is already a part of the patch on #45714, so I'll close as a duplicate. If you would like to add anything to the conversation, please comment there.

Note: See TracTickets for help on using tickets.