WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.

I have two TinyMCE editors on my Theme Options and I'm wondering whether I need to use esc_html() or esc_textarea() in a validation callback before saving the theme option. It seems to me that TinyMCE takes care of a lot of that stuff (as well as the Settings API security that's taken care of), but there's still not a lot of documentation out there about wp_editor().

Any resources and answers appreciated.

share|improve this question
up vote 7 down vote accepted

esc_html() and esc_textarea() are, appropriate to their names, escaping functions and really meant for display rather than sanitizing or validating. I would use wp_kses() or wp_kses_post() (which is just wp_kses() with the global $allowedposttags) to sanitize input from a wp_editor() field before saving.

share|improve this answer
Thanks for your answer @helenhousandi. For you (or anyone else reading this), it seems that @bueltge's answer implies that TinyMCE is essentially doing what wp_kses() does already so it's not necessary. But I don't know the answer (hence the question in the first place), so I'm not the best judge of that. – mrwweb May 10 '12 at 21:45
TinyMCE is capable of doing this, but does not by default. Also realize that a user could switch to using the area as a textarea (HTML mode) instead, so you always need to be sanitizing and validating data on the server side. – helenhousandi May 11 '12 at 1:30

The TinyMCE has an Filter for all allowed tags. You can change the tags, there are set in standard for your options and the editor fitler the tags. Its not necassary, that you filter after save.

Example for enhanced tags:

function fb_change_mce_options( $initArray ) {
    // Comma separated string od extendes tags
    // Command separated string of extended elements
    $ext = 'pre[id|name|class|style],iframe[align|longdesc|name|width|height|frameborder|scrolling|marginheight|marginwidth|src]';
    if ( isset( $initArray['extended_valid_elements'] ) ) {
        $initArray['extended_valid_elements'] .= ',' . $ext;
    } else {
        $initArray['extended_valid_elements'] = $ext;
    // set tiny paramter verify_html
    $initArray['verify_html'] = true;
    return $initArray;
add_filter( 'tiny_mce_before_init', 'fb_change_mce_options' );

You can also filter the tags, all tags inside the array $initArray is allowed. Its easy to kill tags fromthe array. unset( $initArray['pre'] )

read the items inside the array via var_dump( $initArray );


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.