Mustn’t call sanitize_text_field on $_GET as whole
-
Throughout woocommerce-sea.php,
sanitize_text_field
is called on (the entirety of)$_GET
. That is, repeated:sanitize_text_field($_GET)
But
$_GET
is an array, andsanitize_text_field
expects a string.Which causes that function to only return the empty string: See the first lines of the actual filter it calls, _sanitize_text_fields:
if ( is_object( $str ) || is_array( $str ) ) { return ''; }
Either
$_GET
needs to be accessed with a key (not suitable) or checked through other ways, likefilter_var{_array}
orarray_map
.
Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
- The topic ‘Mustn’t call sanitize_text_field on $_GET as whole’ is closed to new replies.