WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css.

Is it silly to worry about malicious code being inserted via un-sanitized theme option text areas when, theoretically, a user could add malicious code just as easily via the standard wordpress theme editor?

These types of theme options would be so helpful, but I'm struggling with the lack of sanitation/validation that comes with implementation.

share|improve this question
Please read about "cross-site script attacks". Your question currently is pretty vague and unclear. Maybe you want to rework it and bring it on topic. As it stands it could also (maybe better) be asked on SO. Hint: You can flag your question and ask the mods to move it. – kaiser Sep 26 '12 at 23:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.