The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
16 views

How to pass an array as attribute of shortcode to work properly shortcode parser?

echo '[test attr="'.json_encode(array('test'=>'my[][dfd]dfds[][][')).'"]'; //How to safe pass the array as attribute in shortcodes ?
0
votes
0answers
27 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
96 views

How to save double quotes in post meta, when the post meta data is an array? [closed]

Ok so I've been scratching my head on this one for a while. I'm making a plugin that adds a custom meta box to a custom post type. I'm using the update_post_meta function to save the data from the ...
0
votes
0answers
21 views

Why does wp add slashes to $_POST? [duplicate]

Why does wp add slashes to $_POST values? All my quotes in my $_POST are escaped.. is there a reason for that??
0
votes
0answers
59 views

Prevent special characters in titles being turned into code

I'm having a problem with Wordpress converting any special characters in my title to the HTML code for that character. For example, if my title is: "Post Title" Wordpress saves this as: ...
1
vote
1answer
53 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
0
votes
3answers
49 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
36 views

wordpress post not showing my “<somehting>” text>?

I am trying to make a post where there is a text line : some libraries to run which we will import by using "#include <filename.h>" command. instead of outputting the text as it is. It ...
1
vote
1answer
153 views

How to correctly escape query variables to be used in WP_Query

I've got custom query variables that are added via query_vars. For example, 'industry'. In pre_get_posts action I construct and add taxonomy query if there is a value for the 'industry' parameter, ...
0
votes
0answers
27 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
0
votes
0answers
36 views

How to escape shortcode content? Do I even need to escape or validate?

I've written a small shortcode that wraps it's content into a HTML element, like so: [my_shortcode]The sun is shining today.[/my_shortcode] In my shortcode function, I basically return the string ...
0
votes
1answer
73 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
1
vote
1answer
338 views

How to sanitize user input?

What is the correct way sanitizing form data before submitting to the database? I have the following text input: <form method="post" action="options.php"> <?php ...
0
votes
0answers
58 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the ...
1
vote
1answer
295 views

Post Content, Special Characters and Filters

I added a hook to the_content. add_filter('the_content', 'edit_the_content'); function edit_the_content($content){ return $content; } Pretty simple right? However, when it output $content from ...
1
vote
1answer
246 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
7
votes
1answer
497 views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
42 views

Escaping a shortcode so it displays as-is [duplicate]

Possible Duplicate: Show shortcode without executing it I've created a plugin that uses a custom shortcode to allow the user to easily split their post into columns. The problem is, when ...
1
vote
3answers
2k views

When do I need to use esc_attr when using WordPress internal functions

When I am putting a WordPress value inside the attribute tag, for example, the following method does not need esc_attr e.g. // JS code alert('<?php echo get_bloginfo('name');?>'); the ...
1
vote
1answer
294 views

Allow all attributes in $allowedposttags tags

I would like to use $allowedposttags to allow extra HTML tags during entry submission. Can I allow all attributes for a specific tag using $allowedposttags? For example, the code below will allow ...
2
votes
1answer
349 views

Prevent add_shortcode from escaping a tag

In my plugin, I'm rendering a shortcode with some inline JavaScript. Wordpress seems to hate the closing CDATA tag (]]>), as it escapes it. I'm using CDATA blocks so as to render well-formed XHTML, ...
1
vote
1answer
1k views

How to use wildcards in $wpdb queries using $wpdb->get_results & $wpdb->prepare?

I am attempting to make a custom search for BuddyPress groups. Here is my method: public function search_groups($string){ global $wpdb; $results = $wpdb->get_results($wpdb->prepare( ...
2
votes
1answer
280 views

How do translated, escaped strings (esc_attr) in Themes work?

I was looking at the TwentyEleven code and found this: esc_attr__( 'Permalink to %s', 'twentyeleven' ) This is come code that came out of the title tag for a post; the full code within the title ...
0
votes
1answer
117 views

esc_url not working within add_settings_field callback

I'm trying to display a saved option of a url inside a text input on my themes' options page, but it's just simply not displaying. I've checked the database and my url is saved using the specified ...
0
votes
1answer
674 views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo "&quot;XSS" print_r( ...
1
vote
1answer
1k views

How to get my post title to work with an apostrophe ('s)?

When saving a post with the title Jule's Gormet, it gets formatted as Jule&#039;s Gormet. If I save it again, it becomes Jule&amp;#039;s Gormet. Following this pattern, it keeps escaping ...
9
votes
2answers
1k views

Should I escape wordpress functions like the_title, the_excerpt, the_content

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
1
vote
1answer
168 views

When I re-save a post with [code] sections, the entities are double-escaped (> becomes &gt; etc)

I've a hard time googling for this issue. On my blog, whenever I update an existing page, code sections are doubly escaped. I.e., on a recent page I have find /V "QWERTYUIOPPO" < ...
0
votes
2answers
425 views

Trouble inserting string containing quotations marks with wpdb in save_post hook

I'm having trouble with inserting a string which is containing quotation marks in wordpress via wpdb. I've written a hook for save_post and trying to write the post_title in a table via wpdp->update. ...
-1
votes
1answer
44 views

problem with quotes on new post

i have a little form to post: $post_content = '"Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit..."'; $post = array( 'post_author' => 1, ...
0
votes
1answer
192 views

how can i send this to wp_head - escape problem

how can escape this char ----> ; i ask becuse i want to use this to send some javascript to the head using wp_head this is want i want to attach to wp_head: add_action('wp_head', ...
8
votes
2answers
1k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., ...
1
vote
1answer
3k views

How do I stop HTML entities in a custom meta box from being un-htmlentitied?

I have a custom meta box that is supposed to accept HTML, but the text I'm trying to input contains both double and single quotes (and ampersands), and it's messing up the saved data - each time I ...
0
votes
1answer
762 views

what's different between esc_attr, htmlspecialchars and htmlentities

Can I simply use htmlspecialchars instead of esc_attr?
1
vote
2answers
2k views

why is esc_html() returning nothing given a string containing a high-bit character?

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
3
votes
1answer
2k views

Difference between esc_url() and esc_url_raw()

http://core.trac.wordpress.org/browser/trunk/wp-includes/formatting.php#L2239 I'm confused about when should either of them be used. Assuming I have this URL: http://site.com/?getsomejavascript=1, ...
1
vote
1answer
505 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...
2
votes
3answers
5k views

How to prevent escaping when saving HTML code in an option value?

I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again. ...
3
votes
1answer
671 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
0
votes
3answers
2k views

Disable escaping html

I'm using SyntaxHighlighter Evolved to highlight code examples. E.g. [csharp] string s = "text"; List<int> numbers = new List<int>(); [/csharp] When I first save it, it's ok, but when ...