superpowers-sage:wp-security

WordPress Security Patterns for Sage/Acorn

When to use

Apply this skill whenever writing or reviewing code that handles user input, renders output, checks permissions, interacts with the database via $wpdb, processes file uploads, or stores sensitive configuration. This skill is also used as a final review pass by the sage-router when other skills produce code.

Inputs required

• The code or feature under review/development
• The context: Blade template, Livewire component, Service class, middleware, or REST endpoint

Procedure

Step 1 — Sanitize on input

Every value originating from the user ($_GET, $_POST, $_REQUEST, form submissions, URL parameters) must be sanitized before storage or processing.

Common sanitization functions:

Function	Use for
sanitize_text_field()	Single-line plain text
sanitize_textarea_field()	Multi-line plain text
sanitize_email()	Email addresses
sanitize_url()	URLs
absint()	Non-negative integers
sanitize_file_name()	File names
wp_kses_post()	Rich HTML (post-level allowed tags)
wp_kses()	HTML with custom allowed tags
sanitize_title()	Slugs

In Acorn Service classes and controllers, sanitize at the point of entry:

public function store(Request $request): void
{
    $title = sanitize_text_field($request->input('title'));
    $body  = wp_kses_post($request->input('body'));
}

Step 2 — Escape on output

Every dynamic value rendered in a Blade template must be escaped. Blade's {{ }} syntax auto-escapes via htmlspecialchars. Use {!! !!} only when you have already sanitized the content and intentionally need raw HTML.

{{-- Safe — auto-escaped --}}
<h1>{{ $post->post_title }}</h1>
<p>{{ get_the_excerpt() }}</p>

{{-- Raw output — only after sanitization --}}
{!! wp_kses_post($post->post_content) !!}

Contextual escaping helpers:

Context	Function
HTML body	esc_html() or {{ }}
HTML attribute	esc_attr()
URL / href	esc_url()
JavaScript inline	esc_js()
Textarea content	esc_textarea()