Uses
| Uses | Description | 
|---|---|
| wp-includes/compat.php: hash_equals() | Timing attack safe string comparison | 
| wp-includes/class-wp-customize-widgets.php: WP_Customize_Widgets::get_instance_hash_key() | Retrieves MAC for a serialized widget instance string. | 
Sanitizes a widget instance.
Unserialize the JS-instance for storing in the options. It’s important that this filter only get applied to an instance once.
(array) (Required) Widget instance to sanitize.
(array|void) Sanitized widget instance.
File: wp-includes/class-wp-customize-widgets.php
public function sanitize_widget_instance( $value ) {
		if ( array() === $value ) {
			return $value;
		}
		if ( empty( $value['is_widget_customizer_js_value'] )
			|| empty( $value['instance_hash_key'] )
			|| empty( $value['encoded_serialized_instance'] ) ) {
			return;
		}
		$decoded = base64_decode( $value['encoded_serialized_instance'], true );
		if ( false === $decoded ) {
			return;
		}
		if ( ! hash_equals( $this->get_instance_hash_key( $decoded ), $value['instance_hash_key'] ) ) {
			return;
		}
		$instance = unserialize( $decoded );
		if ( false === $instance ) {
			return;
		}
		return $instance;
	}  | Version | Description | 
|---|---|
| 3.9.0 | Introduced. | 
    © 2003–2019 WordPress Foundation
Licensed under the GNU GPLv2+ License.
    https://developer.wordpress.org/reference/classes/wp_customize_widgets/sanitize_widget_instance