escaping and sanitizing input for custom widget form fields

1. What is escaping user input?
2. Does ACF sanitize fields?
3. How do I disinfect inputs in WordPress?
4. What is sanitize textfield?
5. Does angular sanitize input?
6. What is the difference between CSRF and XSS?
7. What is Esc_attr in WordPress?
8. Does Get_query_var sanitize?
9. What is Wp_kses?
10. Who owns the trademark of WordPress?

What is escaping user input?

User input is a string. Escaping is done when you want to insert some characters into some HTML / SQL / Whatever code which insists on interpreting some characters into special functionalities.

Does ACF sanitize fields?

Does not sanitize anything on it's own. Custom filters must be hooked in to do the work.

How do I disinfect inputs in WordPress?

The easiest way to sanitize data is with built-in WordPress functions.
...
Example -Simple Input Field #

1. Checks for invalid UTF-8.
2. Converts single less-than characters (<) to entity.
3. Strips all tags.
4. Removes line breaks, tabs and extra white space.
5. Strips octets.

What is sanitize textfield?

sanitize_text_field( string $str ) Sanitizes a string from user input or from the database.

Does angular sanitize input?

Behind the scenes, Angular will sanitize the HTML input and escape the unsafe code, so in this case, the script will not run, only display on the screen as text. Another example, if you will try to bind the src property of an Iframe (or a video):

What is the difference between CSRF and XSS?

The primary difference is that a CSRF attack requires an authenticated session, whereas an XSS attack doesn't. XSS is believed to be more dangerous because it doesn't require any user interaction. ... XSS requires a vulnerability to happen, whereas CSRF relies on tricking the user to click a link or access a page.

What is Esc_attr in WordPress?

Function: esc_attr. Used for: Output being used in the context of an HTML attribute (think "title", "data-" fields, "alt" text). What it does: The exact same thing as esc_html . The only difference is that different WordPress filters are applied to each function.

Does Get_query_var sanitize?

If it's a plugin you're using and the query string parameter is not sanitized, you need to notify that plugin's developer. ... get_query_var() is ONLY for variables that are set as part of the global WP query. That includes a number of WP defaults, along with anything added in a custom manner.

What is Wp_kses?

WordPress Wp_kses is an HTML filtering mechanism. It stands for KSES Strips Evil Scripts. It only allows the safe content and strips rest of the tags. ... Wp_kses function assures only the specified HTML element names, attribute names and values including the sane HTML entities will exist in the output.

Who owns the trademark of WordPress?

The name WordPress is a registered trademark owned by the WordPress foundation. It is a non-profit organization which ensures that WordPress runs successfully as a free open source project.