Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again.

What's the best approach for saving code inserted in an admin page <textarea> using update_option( 'sidebar_code', $_POST['sidebar_code'] ); ?

share|improve this question

3 Answers 3

up vote 3 down vote accepted
stripslashes(wp_filter_post_kses(addslashes($_POST['sidebar_code'])));

but you should know that the kses filter is not 100% safe.

share|improve this answer
    
what do you mean by not 100% safe? –  Amit Jan 13 '11 at 22:09
    
I mean someone could still XSS your site if they are really good at it. If I'm not mistaken the last wp patch fixed a xss vulnerability in the kses functions –  onetrickpony Jan 14 '11 at 0:29
    
kses strips out all of the extra class and html attributes (e.g. class="classname" width="100") is there any way to get around that? –  Talon Oct 17 '12 at 22:07

I took another approach to this. I encoded and decoded my options with HTML entities. One thing I'm not sure of is whether this opens up a nasty back door for folks to drive compromising HTML through. I am relying on the fact that only admins will be editing theme options anyway, but maybe I'm being naive?

Here is what it looks like when I save an option:

update_option('my_option', htmlentities(stripslashes($_REQUEST['my_option'])));

And this is what it looks like when I retrieve an option:

html_entity_decode(get_option('my_option',htmlentities($my_default_value)));
share|improve this answer

This isn't a complete answer to your question, but possibly pointing you in the right direction: You could try <?php esc_textarea( $text ) ?>, as detailed by the codex here: http://codex.wordpress.org/Function_Reference/esc_textarea.

My own metabox textarea snippets look like this:

<?php 
  if ( $meta_box['type'] == "textarea" ) {
    $meta_box_value = esc_textarea( get_post_meta($post->ID, $meta_box['name'].'_value', true) );
    echo '<textarea class="meta-textarea" style="width: 100%;" cols="20" rows="2" name="' . $meta_box['name'] . '_value">' . $meta_box_value . '</textarea><br />';
  }
?>
share|improve this answer
    
Depends on what you are doing. esc_textarea will convert any html to HTML entities codes, so you can't use it with a richtext area like tinyMCE. –  Jake Jul 16 '12 at 15:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.