How to correctly escape query variables to be used in WP_Query

I’ve got custom query variables that are added via query_vars. For example, ‘industry’.

In pre_get_posts action I construct and add taxonomy query if there is a value for the ‘industry’ parameter, like so:

Read More
add_action( 'pre_get_posts', 'alter_posts');
function alter_posts( $q ) {
    $tax_query = array();

    // industry taxonomy
    if ( get_query_var( 'industry' ) ) {
        $tax_query[] = array(
            'taxonomy' => $my_taxonomy,
            'field' => 'slug', 
            'terms' => get_query_var( 'industry' )
        );
    }

    // set all previously determined values to the query
    $q->set( "tax_query", $tax_query );
}

How do I correctly escape query variable that I get via get_query_var( 'industry' )?

Do I use esc_sql function, like so esc_sql( get_query_var( 'industry' ) ) ? What’s the correct way to handle the escaping of query variables?

Many thanks,
Dasha

Related posts

1 comment

Comments are closed.