Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be totally eating a string containing a high-bit character. Here's the example, written as a simple WP plugin:

<?php
/*
Plugin Name: bugz tester
*/
class bugz_tester { 
    function __construct() {
        if ( ! is_admin() )
            return;

        add_action('admin_menu', array(&$this,'admin_page'));   
    }

    function admin_page() { 
        add_options_page('Bugz tester', 'bugz', 'edit_posts', 'bugz_sheet', array(&$this,'test_page'));
    }


    function test_page() {    
        ?>
        <div class="wrap">
        <?php
        $ts = 'blah à blah';
        echo "original: " . $ts . "<br/>" ;
        echo  "PHP sanitized: " . $this->sanitize_txt( $ts ) . "<br/>" ;
        echo  "WP sanitized: " . esc_html( $ts ) . "<br/>";               
        die();
        ?>
        </div>
        <?php
    }

    function sanitize_txt ( $text ) {
        $san_text = filter_var($text, FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_HIGH | FILTER_FLAG_STRIP_LOW ) ;
        return $san_text;
    }   

}
new bugz_tester();
?>

Here's the output:

original: blah � blah
PHP sanitized: blah à blah
WP sanitized:

I'm not obsessed with using esc_html(). But if I use instead filter_var(), the string vanishes when I add it to a WP custom field. Somehow WP sanitation is killing the string.

I'm mystified. Would be grateful for a clue.

share|improve this question
    
Additional note: Using the handy WP Debug console wordpress.org/extend/plugins/debug-bar-console I tried –  BigToe Apr 15 '11 at 19:36
    
I entered into the WP console 'echo esc_html('blah à blah');' which produced 'blah à blah'. So esc_html works differently in different contexts???? @chip-bennett –  BigToe Apr 15 '11 at 19:46

2 Answers 2

Perhaps because the entity is a non-UTF8 character?

Here's what esc_html() does:

function esc_html( $text ) {
      $safe_text = wp_check_invalid_utf8( $text );
      $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
      return apply_filters( 'esc_html', $safe_text, $text );
}

If not that, then it's getting sanitized when filtered by _wp_specialchars(), which does double-encoding(by default,no) and all sorts of things.

For reference:

1) esc_html() in source

2) _wp_specialchars() in source

share|improve this answer
    
In the example above, &#224; is a UTF-8 character. See –  BigToe Apr 15 '11 at 19:20
    
[à] U+00E0 &#224; LATIN SMALL LETTER A WITH GRAVE at columbia.edu/kermit/utf8-t1.html –  BigToe Apr 15 '11 at 19:20

Using the PHP filter_var() function with appropriate filters does allow the sanitized text to be inserted into the meta field. What's going on with esc_html seems to be some obscure character coding issue.

WordPress 3.2 will require PHP 5.2. So, if you're having trouble with the WP esc_html() function, the PHP 5.2 filter_var is a good alternative.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.