WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is an example:

$allowedPart = "<a href='http://alink.com'></a>";
$unsafePart = "<h1>A title</h1>";
$unsafePart .= "<script>alert('a script!!!');</script>";

$unsafeString = $allowedPart . $unsafePart;

$allowed = array("a"=>array(

$sanitizedString = wp_kses($unsafeString, $allowed);

$sanitizedString should be equals to $allowedPart, but something goes wrong and $sanitizedString remains the same as $unsafeString.

What's wrong?


Sorry, after saving to the database, I did location.reload(), and consequently in the textarea was maintained the original content, but in database the value is almost correct. This secondary issue was solved using:

window.location.href = window.location.href;

However there is a problem, 'href' disappears too, why?

For example

<a href='http://alink.com'>Link</a> becomes <a>Link</a>

Trying something like: $allowed = array( 'img'=>array( 'src'=>array(), ));

<img src='img.png' /> becomes <img />

It's as if wp_kses() recognize as unallowed all the attributes in sub-array (like href or src), filtering them and their content.


Using double quotes instead of single ones seems to solve.

$allowed = array( 'img'=>array( 'src'=>array(), ));

<img src="img.png" />

share|improve this question

wp_kses (Codex) removes unallowed tags, but it doesn't remove their content. So, if you have a "{something}", wp_kses only removes the tags, not the content, returning "{something}". Thus, this is intended behaviour and your issue doesn't seem to be a bug.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.