Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm very new to WP, and from following books and online examples, I have several different 'esacping' functions in my first plugin. I would like to know if there is one function, or a minimal set of functions, I can use to prevent malicious HTML stored in my DB from doing anything bad. I would, however, always like to store text exactly as it is captured, and only sanitize it when presenting it.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Well, I would start with the one called esc_html().

EDIT

Longer answer:

You should perform sanitization on input, and escaping on output.

To sanitize HTML content on input, I would use one of the kses() family of filters - particularly, wp_kses_post(), which will filter all but the HTML tags allowed via the Post Editor.

To escape HTML content on output, I would use esc_html(), which escapes HTML blocks for output.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.