The escaping tag has no wiki summary.
1
vote
1answer
57 views
wp_specialchars and wp_specialchars_decode in a shortcode plugin
I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them.
The plugin read a shortcode allowing some parameters ...
6
votes
1answer
145 views
From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
33 views
Escaping a shortcode so it displays as-is [duplicate]
Possible Duplicate:
Show shortcode without executing it
I've created a plugin that uses a custom shortcode to allow the user to easily split their post into columns.
The problem is, when ...
0
votes
3answers
201 views
When do I need to use esc_attr when using WordPress internal functions
When I am putting a WordPress value inside the attribute tag, for example, the following method does not need esc_attr
e.g.
// JS code
alert('<?php echo get_bloginfo('name');?>');
the ...
1
vote
1answer
74 views
Allow all attributes in $allowedposttags tags
I would like to use $allowedposttags to allow extra HTML tags during entry submission. Can I allow all attributes for a specific tag using $allowedposttags?
For example, the code below will allow ...
2
votes
1answer
101 views
Prevent add_shortcode from escaping a tag
In my plugin, I'm rendering a shortcode with some inline JavaScript. Wordpress seems to hate the closing CDATA tag (]]>), as it escapes it. I'm using CDATA blocks so as to render well-formed XHTML, ...
0
votes
1answer
182 views
How to use wildcards in $wpdb queries using $wpdb->get_results & $wpdb->prepare?
I am attempting to make a custom search for BuddyPress groups.
Here is my method:
public function search_groups($string){
global $wpdb;
$results = $wpdb->get_results($wpdb->prepare(
...
1
vote
1answer
113 views
How do translated, escaped strings (esc_attr) in Themes work?
I was looking at the TwentyEleven code and found this:
esc_attr__( 'Permalink to %s', 'twentyeleven' )
This is come code that came out of the title tag for a post; the full code within the title ...
0
votes
1answer
76 views
esc_url not working within add_settings_field callback
I'm trying to display a saved option of a url inside a text input on my themes' options page, but it's just simply not displaying. I've checked the database and my url is saved using the specified ...
0
votes
1answer
257 views
Something is unescaping all html entities before output to browser [closed]
I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases:
echo ""XSS"
print_r( ...
1
vote
1answer
444 views
How to get my post title to work with an apostrophe ('s)?
When saving a post with the title Jule's Gormet, it gets formatted as Jule's Gormet. If I save it again, it becomes Jule&#039;s Gormet.
Following this pattern, it keeps escaping ...
5
votes
2answers
438 views
Should I escape wordpress functions like the_title, the_excerpt, the_content
I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
1
vote
1answer
106 views
When I re-save a post with [code] sections, the entities are double-escaped (> becomes > etc)
I've a hard time googling for this issue. On my blog, whenever I update an existing page, code sections are doubly escaped. I.e., on a recent page I have
find /V "QWERTYUIOPPO" < ...
0
votes
2answers
204 views
Trouble inserting string containing quotations marks with wpdb in save_post hook
I'm having trouble with inserting a string which is containing quotation marks in wordpress via wpdb.
I've written a hook for save_post and trying to write the post_title in a table via wpdp->update.
...
-1
votes
1answer
41 views
problem with quotes on new post
i have a little form to post:
$post_content = '"Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit..."';
$post = array( 'post_author' => 1,
...
0
votes
1answer
150 views
how can i send this to wp_head - escape problem
how can escape this char ----> ;
i ask becuse i want to use this to send some javascript
to the head using wp_head
this is want i want to attach to wp_head:
add_action('wp_head', ...
6
votes
2answers
706 views
Should HTML output be passed through esc_html() AND wp_kses()?
I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., ...
1
vote
1answer
1k views
How do I stop HTML entities in a custom meta box from being un-htmlentitied?
I have a custom meta box that is supposed to accept HTML, but the text I'm trying to input contains both double and single quotes (and ampersands), and it's messing up the saved data - each time I ...
0
votes
1answer
534 views
what's different between esc_attr, htmlspecialchars and htmlentities
Can I simply use htmlspecialchars instead of esc_attr?
1
vote
2answers
1k views
why is esc_html() returning nothing given a string containing a high-bit character?
In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
3
votes
1answer
790 views
Difference between esc_url() and esc_url_raw()
http://core.trac.wordpress.org/browser/trunk/wp-includes/formatting.php#L2239
I'm confused about when should either of them be used.
Assuming I have this URL: http://site.com/?getsomejavascript=1, ...
1
vote
1answer
418 views
How Could I sanitize the receive data from this code
<form id="tellastory" method="post" action="">
<label for="fullname">Full Name </label>
<input id="fullname" name="fullname" type="text" maxlength="255" value=""/>
...
2
votes
3answers
2k views
How to prevent escaping when saving HTML code in an option value?
I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again.
...
0
votes
3answers
872 views
Disable escaping html
I'm using SyntaxHighlighter Evolved to highlight code examples.
E.g.
[csharp]
string s = "text";
List<int> numbers = new List<int>();
[/csharp]
When I first save it, it's ok, but when ...
