How to validate data in WordPress

WordPress is often viewed as being an insecure platform, but the truth is that it is highly secure and comes equipped with features that allow third-party plugins to also be secure. The problem is that not everyone is aware of these security features or knows how to use them properly, which can lead to third-party plugins introducing vulnerabilities and giving WordPress a bad reputation for security.

To help address this issue, WordPress provides developers with a useful guide on validating data, which is an essential step in ensuring the security of your WordPress website. There are also several functions available for sanitizing data in WordPress, which can help protect your site against malicious attacks.

By using these and other functions in your WordPress code, you can help keep your WordPress website secure and protect it against potential vulnerabilities.

Here are some key functions for validating data in WordPress.

Numbers

The native PHP is_int() and is_float() functions can be used to check you have a valid number.

The function takes a string or a number and returns true if it is valid, and false if it is not.

$number = 12.34
if ( is_int( $number  ) ) {
    // The number is an interger - e.g. 12
}
if ( is_float( $number) ) {
    // The number is a float - e.g. 12.34
}

Email address

The is_email() function can be used to check you have a valid email address.

The function takes a string as an argument and returns true if the string is a valid email address, and false if it is not.

$email = '[email protected]';
if ( is_email( $email ) ) {
    // The email address is valid
}

URL

To validate a URL, you can use the wp_http_validate_url() function.

The function takes a string as an argument and returns true if the string is a valid URL, and false if it is not.

$url = 'https://www.example.com/';
 if ( wp_http_validate_url( $url ) ) {
    // The URL is valid
}

IP address

To validate an IP address, you can use the rest_is_ip_address() function.

The function takes a string as an argument and returns true if the string is a valid IP address, and false if it is not.

$ip_address = '192.168.1.1';
if ( rest_is_ipaddress( $ip_address ) ) {
    // The IP address is valid
}

WordPress username

To validate a WordPress username, you can use the username_exists() function.

The function takes a string as an argument and returns true if the username exists in the WordPress database, and false if it does not.

$username = 'admin';
if ( username_exists( $username ) ) {
    // The username exists
}

Custom validation using regex (regular expressions)

In addition to these built-in functions, you can also use custom validation rules and regular expressions to validate different types of data in WordPress.

For example, if you want to validate a phone number that starts with 04 and then 8 numbers, you could use a regular expression.

For example:

$phone = "0412345678";
$pattern = '/^04\d{8}$/';
if ( return preg_match($pattern, $phone) === 1 ) {
    // phone number starts with 04 and then 8 numbers
}