WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a form that allows any registered user to submit a post (it's a custom post type - forum related), and I'm using wp_insert_post() to insert it into the db.

From what I've seen in this function a sanitize_post() function is run automatically, but I think this only handles db escaping and such.

So how do I sanitize the input data the same way as the wp-admin editor does? I mean apply the kses filter and all the other stuff...

share|improve this question
up vote 4 down vote accepted

When a post is created/edited from the admin, edit_post() is called.

This function simply collects all the $_POST arguments and passes them to wp_update_post().

wp_update_post() then does some more logical checks and passes the data along to wp_insert_post().

wp_insert_post() calls sanitize_post(), which does all the heavy duty sanitization.

So, yes, wp_insert_post() is the correct way to do it.

share|improve this answer
but I still can submit any type of HTML, like <script> etc. so wp_filter_kses() is not applied to the post_content from wp_insert_post() ? In the admin it seems it is. – onetrickpony Feb 16 '11 at 18:09
First, make sure the user you're logged-in as does not have the 'unfiltered_html' capability. – scribu Feb 16 '11 at 22:05
can editors post unfiltered html? – onetrickpony Feb 17 '11 at 3:27
You can find out with a plugin, such as Capability Manager – scribu Feb 17 '11 at 14:32

Otto did a blog about using kses last year, see if that helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.