Flag any non-validated/sanitized $_GET, $_POST, $_REQUEST, $_SERVER

[westonruter]

While we should also sanitize/validate data returned from the database (post meta and options), adding checks for all functions and methods which access the database (post data, post meta, options, etc) is very difficult since there are so many. Furthermore, the severity of validating and sanitizing data coming from the database is much less important than validating and sanitizing data coming directly from the user via $_GET and $_POST, since WordPress already sanitizes much of the data going into the DB, and the WordPress API functions will often sanitize the data they return automatically.

• Flag any use of $_GET, $_POST, $_REQUEST, or $_SERVER which is not wrapped in a sanitizing/validating function.
• Allow use of isset and empty among other sanitization functions.

http://codex.wordpress.org/Data_Validation
http://php.net/manual/en/function.filter-var.php

Validation, Sanitization, and Escaping #

$_GET, $_POST, $_REQUEST, $_SERVER and other data from untrusted sources (including values from the database such as post meta and options) need to be validated and sanitized on save and escaped on output.

[shadyvb]

Speaking of which, shouldn't the filter_var* / filter_input* family be included in the XSS Sniff's sanitizing functions list ?

[westonruter]

@shadyvb yes!

[shadyvb]

@westonruter Requested in #99