Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a custom post textbox that I want to sanitize using wp_kses before I update my post meta.

I was looking for examples of common $allowed settings, but I have only seen this example:

$allowed = array(  
        'a' => array( // on allow a tags  
            'href' => array() // and those anchors can only have href attribute  
        )  
    );  

What is a typical wp_kses $allowed setting? Can someone provide an example of what they normally filter for?

share|improve this question
    
This question is out of scope for the site as there is more than one correct answer. If you narrow the scope of the question, present a usage case and ask for someone to provide you with things you should include that would be much better. –  m0r7if3r Mar 7 '12 at 16:35
    
I want to have a rich text box where the user can just enter regular text, bold, links, italics... –  redconservatory Mar 7 '12 at 17:31
add comment

4 Answers 4

up vote 3 down vote accepted

I would disagree with the solution posted by @JaredCobb, wp_kses() is much more flexible than the method he presented. It can strip out unwanted attributes from tags without destroying the tags themselves. For example, if the user put in <strong class='foo'>, wp_kses() would return <strong> if you did not allow class, whereas strip_tags() would remove the <strong> completely.

@redconservatory: The attributes you'll want to use are as follows:

$args = array(
    //formatting
    'strong' => array(),
    'em'     => array(),
    'b'      => array(),
    'i'      => array(),

    //links
    'a'     => array(
        'href' => array()
    )
);

This will allow bold and italics with no attributes, as well as anchor tags with an href attributes...and nothing else. It uses the whitelisting principle, which @jaredcobb rightly noted is the better way to go here.

share|improve this answer
    
Can't you tell strip tags what tags are allowed? php.net/manual/en/function.strip-tags.php –  redconservatory Mar 7 '12 at 18:30
    
Although, I can still see how wp_kses is better now that I can see how it strips out unwanted classes... –  redconservatory Mar 7 '12 at 18:31
    
I probably didn't explain clearly... But yes, wp_kses allows more control than the native PHP options. I think I said that. I used the word "attributes" as well. I was saying it depends on your use case. Someone trying to protect their data from all tags would be better off using strip_tags IMHO but it's more of my preference than anything else. Cheers. –  Jared Cobb Mar 7 '12 at 22:59
add comment

I would start out with the same $allowedtags array that WordPress uses for their comments. You can find their array in the [wordpress directory]/wp-includes/kses.php file. These seem like sensible defaults to me, and a good starting point. Here is their array...

$allowedtags = array(
    'a' => array(
        'href' => true,
        'title' => true,
    ),
    'abbr' => array(
        'title' => true,
    ),
    'acronym' => array(
        'title' => true,
    ),
    'b' => array(),
    'blockquote' => array(
        'cite' => true,
    ),
    'cite' => array(),
    'code' => array(),
    'del' => array(
        'datetime' => true,
    ),
    'em' => array(),
    'i' => array(),
    'q' => array(
        'cite' => true,
    ),
    'strike' => array(),
    'strong' => array(),
);

I would NOT use PHP's strip_tags as a replacement for wp_kses.

You should never use strip_tags to filter an unknown user's content!

I have created a quick video explaining Why WordPress’ wp_kses() is better than PHP’s strip_tags() for security.

share|improve this answer
add comment

I've only used wp_kses when I've specifically needed to allow / filter attributes of HTML tags (for example, I want them to be allowed to have an <image> tag, with a src="" attribute but I don't want them to be able to but href="" or style="" or anything else on the image tag. In that case, wp_kses comes in handy because (as you can see in the example you created) you can filter down very specifically. I've rarely used wp_kses though because I just find that a couple of native PHP functions (below) do the trick and are easier to understand when I look at the code several months later.

If you want to completely remove HTML tags (except maybe allow a few) then I always use strip_tags. You can pass in a string of allowed tags (like <p> <br> <strong>) or whatever other harmless tags you like. This allows the user to be able to have some control over formatting, if that's applicable for your use case. I like strip_tags because it takes a whitelist approach to sanitizing your data. (Meaning that everything gets stripped except what you explicitly whitelist).

If your goal is to allow them to put any HTML into the content, but you just want to show their text as they entered it (like code examples) then use htmlspecialchars. This will convert HTML characters into their encoded counterparts so you can safely output it to the page.

You might come across code using str_replace which "looks" for bad tags like or or whatever. I really don't recommend that approach because it takes a blacklist approach to sanitizing data and you've got to constantly make sure your blacklist is up to date.

I guess to sum up, it depends on what your metaboxes are used for. If you're protecting against input from users (who might be malicious) I'd recommend strip_tags and just allow some of the harmless tags. If you have a good business case to really micromanage the tags and specific attributes of the user's content, use wp_kses.

share|improve this answer
add comment

You could also use wp_kses_post function which is used on post content and requires only data as a parameter.

More info here: http://codex.wordpress.org/Function_Reference/wp_kses_post

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.