WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress http://codex.wordpress.org/Function_Reference/esc_html

However I am thinking a secure approach, so I would like to add HTML purifier and CSSTidy like it's illustrated here: http://stackoverflow.com/questions/3241616/sanitize-user-defined-css-in-php

Is this necessary? Or Wordpress core function like esc_html already uses HTML purifier so this is not anymore needed. Please advise. Thanks.

share|improve this question
+1 for good question and good link. Maybe you want to copy this over here (and leave a link to the source + the name of the author below it). – kaiser Feb 13 '13 at 8:30
up vote 0 down vote accepted

If you worry only about the admin panel then esc_html will be enough as it will convert every "<" into &lt; eliminating the possibility of having a valid HTML tags inserted.

But if you add the CSS to the generated HTML you might need to strip any HTML tag it may contain by using the wp_kses function

$css = wp_kses($css,array(),array());

should strip all possible HTML from the CSS.

But stripping is not needed at all if the user has unfiltered_html capability, usually the admin of a stand alone site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.