Skip to content

Conversation

@IanDelMar
Copy link
Contributor

The return type of sanitize_post_field() depends on both the $field being sanitised and the $context.

For integer fields

$int_fields = array( 'ID', 'post_parent', 'menu_order' );

it returns an integer. If $value is of type int, we can even return a constant integer or an integer range.

For the field value 'ancestors, it returns an array with non-negative integer values.

For all other fields, the type depends on the $context:

  • 'raw': $value is returned as is, which is handled via the template T; for constant types, the same constant type is returned.
  • 'attribute'|'edit'|'js': $value is escaped--and may be transformed--using esc_attr(), esc_html(), or esc_js(). Assuming the filters in these functions do not alter the type, the returned type is string, even if $value is a constant string. The only exception is the field value 'post_content' which might be filtered but is only escaped if user_can_richedit() === false. In this case the default return type of mixed is retained.
  • All other $context values: $value is not escaped but is filtered, with the filter callback documented as returning mixed. Therefore, the default return type of mixed is retained.

Related: #382, szepeviktor/phpstan-wordpress#297

@szepeviktor szepeviktor merged commit 313ec71 into php-stubs:master Sep 8, 2025
7 checks passed
@IanDelMar IanDelMar deleted the sanitize_post_field branch September 9, 2025 01:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants