WordPress Security in WordPress - Sanitization Sanitize user name
Example
$user = sanitize_user("attacker username<script>console.log(document.cookie)</script>");
$user value after sanitize is "attacker username"
$user = sanitize_user("attacker username<script>console.log(document.cookie)</script>");
$user value after sanitize is "attacker username"
