Input sanitization & validation

When to use this skill

Use this skill whenever a value enters your code from outside:

• Superglobals: $_GET, $_POST, $_REQUEST, $_COOKIE, $_SERVER.
• REST API parameters, AJAX payloads, form fields.
• Shortcode attributes, block attributes, widget settings.
• Values read back from get_option, post meta, or user meta that originated from users.
• Bodies returned by remote APIs (wp_remote_get, etc.).

Sanitize on input, escape on output — two different jobs. This skill covers input; see output-escaping for output.

Core principles (and why they matter)