WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a plugin where the user can define shortcode tags himself. What would you suggest to allow in there? My thought is only allow ascii characters.

So how do I sanitize? strip_tags and then regex to allow only a-z, 0-9 or is there a better solution? Does WordPress have filter for that? Could I maybe use the filter WordPress uses for slugs?

thanks for the answers i will just do this, if there must be one ascii char anyway then i just require three.

foreach ( $shortcodes as $key => $var ) {

$var = preg_replace('/[^a-z0-9_]/', '', $var ); // strip away everything except a-z,0-9 underscore

if ( strlen($var) < 3 )
    continue; // if less then 3 chars AFTER the strip don't save
share|improve this question
up vote 1 down vote accepted

You can use almost every character. Just the character / is dangerous. Do not allow it. WordPress is using preg_quote to escape the shortcode name, but it doesn't include its own regex delimiter / when doing that. So the shortcode will not be properly escaped and you get a PHP warning.

Besides that, there are just two basic rules for a shortcode name:

  1. It should be at least two characters long.
  2. It should contain at least one US-ASCII character (a-z0-9).

So this works:

foreach ( array ( '.-o', ']b', 'äoß', 'o"o', "o'o", '❤m' ) as $shortcode )
    add_shortcode( $shortcode, 't5_crazy_shortcode_handler' );

function t5_crazy_shortcode_handler( $attrs = array(), $content = NULL, $shortcode )
    return "<pre>\$shortcode: $shortcode\n\n\$attrs\n"
        . htmlspecialchars( print_r( $attrs, TRUE ) )
        . "\n\n\$content"
        . htmlspecialchars( print_r( $content, TRUE ) )
        . '</pre>';
share|improve this answer

It seems WordPress has some issues with shortcodes tags that have hyphens, so you probably want to avoid that. Unsure if this is still an issue with WP 3.3.x.

Most of the 'sanitize' functions in WP's wp-includes/formatting.php file (like sanitize_title) do work similar to what you might need, but they do allow hyphens. If you only want to return alphanumeric, and not hyphens, you'd probably better off to write a function that takes a string, uses preg_replace to remove spaces and only do alphanumeric. You could replace the spaces with underscores, since it doesn't look like the Shortcode API has issues with those in shortcode tags.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.