Security Notes
Security considerations for wpzylos-validation.
Validation Is Not Security
Validation checks format. It doesn't prevent attacks:
// Validation passes but value is malicious
$validator->validate(['name' => '<script>alert(1)</script>'], [
'name' => 'required|string',
]); // Passes!
// Still need sanitization before use
$name = $sanitizer->text($input['name']);
Don't Trust Validation Alone
SQL Injection
Validation doesn't prevent SQL injection:
// Bad: Still vulnerable
$id = $request->input('id');
if ($validator->validate(['id' => $id], ['id' => 'numeric'])->passes()) {
$wpdb->query("SELECT * FROM users WHERE id = {$id}");
}
// Good: Use prepared statements
$wpdb->prepare("SELECT * FROM users WHERE id = %d", $id);
XSS
Validated data requires escaping on output:
// Validation doesn't sanitize HTML
$validated = $result->validated();
// Still escape on output
echo esc_html($validated['title']);