WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like:


I then realized you can also enter:

<script> </script> 

into the post content box. Is there a way to hook into the validation and make it so that script can't be entered?

Am I wrong in thinking that a hacker with access to the backend could use the fields to get malicious script to the database?

I guess I'm just a bit confused because when using the settings api ( or even creating custom metaboxes ) there's so much emphasis put onto proper validation/escaping. Yet, on post pages you can enter whatever you want? Thanks!

share|improve this question
If an intruder already has acquired access to the admin backend, post content validation should not be one of your primary concerns... – Johannes Pille Apr 16 '13 at 14:33
Imagine you don't get what you've passed to that custom fields... – Zlatev Apr 16 '13 at 14:37
That's true, I guess I just don't understand why validation and sanitation are stressed so much with settings/custom meta boxes when the same can be said in those situations too. – Ben Apr 16 '13 at 15:39

Unfiltered HTML in post content and title is a capability usually reserved for admins. If you don’t want to allow that for your users, don’t make them admins.

Sanitation of custom fields has to be provided by the code author. There are use cases for such fields where entering JavaScript code is a desired feature. Again, if you don’t want that, disable it.

This is not a security issue: you can control everything, and you should not install code you didn’t read and understand. That part is not WordPress specific. :)

share|improve this answer
What do I hook into in order to disable it? – Ben Apr 16 '13 at 15:44
codex.wordpress.org/Function_Reference/remove_post_type_support this should do the trick – Kevin D. Apr 16 '13 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.