Search code examples
phpwordpresswoocommercecheckoutsanitization

Sanitize custom checkout fields data in WooCommerce


Following the WooCommerce checkout fields customization docs:
Customizing checkout fields using actions and filters

I have added a custom field to woocommerce checkout page, through functions.php.

I'm worried if I have to sanitize user input for that custom field?

I think it doesn't need sanitization since it's passed into billing fields as in: $fields['billing'], is that correct?

If not how do I sanitize this custom field?

Creating this custom field is meant to accept text strings(latin) and integers combined no longer than 50 in length.

// Hook in
add_filter( 'woocommerce_checkout_fields' , 'custom_override_checkout_fields' );

// Our hooked in function - $fields is passed via the filter!
function custom_override_checkout_fields( $fields ) {

//Adding custom text field  
 $fields['billing']['billing_username'] = array(
'type' => 'text',
'label'     => __('Your Username', 'woocommerce'),
'placeholder'   => _x('', 'placeholder', 'woocommerce'),
'required'  => true,
'class'     => array('form-row-first'),
'clear'     => true
 );

 return $fields;
}

Solution

  • If you look to the related Official Documentation linked in your question, you've got this snippet:

    /**
     * Update the order meta with field value
     */
    add_action( 'woocommerce_checkout_update_order_meta', 'my_custom_checkout_field_update_order_meta' );
    
    function my_custom_checkout_field_update_order_meta( $order_id ) {
        if ( ! empty( $_POST['my_field_name'] ) ) {
            update_post_meta( $order_id, 'My Field', sanitize_text_field( $_POST['my_field_name'] ) );
        }
    }
    

    In your case you don't need that as address fields are already processed by Woocommerce.

    For custom special fields: The answer is yes (which is not your case)

    As you can see in this code they use sanitize_text_field() WordPress function, when saving the submitted data to database with update_post_meta() function…

    This is only for custom checkout fields and not for existing checkout fields, that already get their own process…