← All changes | classes/class-utils.php +20 -1 2.0.9 → trunk View file →

		@@ -129,8 +129,12 @@
129	129
130	130	/**
131	131	* Get a sanitized input text field.
132	132	*
	133	+ * Reads directly from the superglobals rather than filter_input(), which has a
	134	+ * long-standing PHP/SAPI bug where INPUT_POST/INPUT_GET can return NULL even
	135	+ * though the superglobal has the value.
	136	+ *
133	137	* @param int $type The type to get.
134	138	* @param string $var The value to get.
135	139	*
136	140	* @return mixed
		@@ -135,8 +139,23 @@
135	139	*
136	140	* @return mixed
137	141	*/
138	142	public static function get_sanitized_text( $type, $var ) {
139		- return filter_input( $type, $var, FILTER_CALLBACK, array( 'options' => 'sanitize_text_field' ) );
	143	+
	144	+ switch ( $type ) {
	145	+ case INPUT_POST:
	146	+ $value = isset( $_POST[ $var ] ) ? wp_unslash( $_POST[ $var ] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
	147	+ break;
	148	+ case INPUT_GET:
	149	+ $value = isset( $_GET[ $var ] ) ? wp_unslash( $_GET[ $var ] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	150	+ break;
	151	+ case INPUT_SERVER:
	152	+ $value = isset( $_SERVER[ $var ] ) ? wp_unslash( $_SERVER[ $var ] ) : null;
	153	+ break;
	154	+ default:
	155	+ $value = null;
	156	+ }
	157	+
	158	+ return null === $value ? null : sanitize_text_field( $value );
140	159	}
141	160
142	161	}