How can i protect against injection when updating the post_meta using ajax and update_post_meta() in WordPress?

Question

How can I protect against injection when updating the post_meta using ajax and update_post_meta() in WordPress? I am worried the user input on my site makes it vulnerable to injection and other nasty stuff i can't think of.

I am new to WordPress development and web development.

I am building a system where the user can log in and update various information about their business which then gets saved to the MySQL database(in the future I will get this data using the WordPress REST API from a client app). So I build the profile page and made a form for the user input and then send the data using ajax and WordPress' update_post_meta() function. This is my ajax callback:

/**
* AJAX Callback
* Always Echos and Exits
*/
function lla_update_profil_meta_callback() {

// Ensure we have the data we need to continue
if( ! isset( $_POST ) || empty( $_POST ) || ! is_user_logged_in() ) {

    // If we don't - return custom error message and exit
    header( 'HTTP/1.1 400 Empty POST Values' );
    echo 'Could Not Verify POST Values.';
    exit;
}

// Get our    current post ID
$post_id        = lla_get_post_id();     
if($post_id != null){

    //get all the values from $_POST
    $um_val         = sanitize_text_field($_POST['kategori_id'] ) ;      
    $selected_term_data = get_term((int)$um_val);
    $new_post_title = sanitize_text_field($_POST['post_title']);

    //these are the values and im guessing it should be here i protect against injection?
    $new_beskrivelse = $_POST['beskrivelse'];
    $new_telefon = $_POST['telefon'];
    $new_email = $_POST['email'];
    $new_website = $_POST['website'];
    $new_vejnavn = $_POST['vejnavn'];
    $new_husnummer = $_POST['husnummer'];
    $new_salside = $_POST['salside'];
    $new_postnummer = $_POST['postnummer'];
    $new_by = $_POST['by'];


    update_post_meta( $post_id, 'kategori_id', $um_val);
    update_post_meta($post_id, 'beskrivelse', $new_beskrivelse); 
    update_post_meta($post_id, 'telefon', $new_telefon);
    update_post_meta($post_id, 'email', $new_email);
    update_post_meta($post_id, 'website', $new_website);
    update_post_meta($post_id, 'vejnavn', $new_vejnavn);
    update_post_meta($post_id, 'husnummer', $new_husnummer);
    update_post_meta($post_id, 'salside', $new_salside);
    update_post_meta($post_id, 'postnummer', $new_postnummer);
    update_post_meta($post_id, 'by', $new_by);

    //make sure the category chosen is updated in the backend aswell
    wp_set_object_terms($post_id, (int)$um_val, $selected_term_data->taxonomy, false);
    //updating post-title
    $my_post = array(
      'ID'           => $post_id,
      'post_title'   => $new_post_title,
      'post_name' => $new_post_title,
    );
    wp_update_post($my_post);

}else{
    echo "no post";
}
exit;
}
add_action( 'wp_ajax_nopriv_um_cb', 'lla_update_profil_meta_callback' );
add_action( 'wp_ajax_um_cb', 'lla_update_profil_meta_callback' );

How can I make this more secure?

Answer 1

use functions like:

esc_sql();
esc_attr();
esc_html();

Also see Validating Sanitizing and Escaping User Data
Example:

$new_beskrivelse = esc_sql($_POST['beskrivelse']);
$new_telefon = esc_sql($_POST['telefon']);
$new_email = esc_sql($_POST['email']);
$new_website = esc_sql($_POST['website']);