The tag has no usage guidance.

learn more… | top users | synonyms

8
votes
1answer
1k views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
55 views

Escaping a shortcode so it displays as-is [duplicate]

Possible Duplicate: Show shortcode without executing it I've created a plugin that uses a custom shortcode to allow the user to easily split their post into columns. The problem is, when ...
2
votes
1answer
706 views

Prevent add_shortcode from escaping a tag

In my plugin, I'm rendering a shortcode with some inline JavaScript. Wordpress seems to hate the closing CDATA tag (]]>), as it escapes it. I'm using CDATA blocks so as to render well-formed XHTML, ...
2
votes
1answer
903 views

How do translated, escaped strings (esc_attr) in Themes work?

I was looking at the TwentyEleven code and found this: esc_attr__( 'Permalink to %s', 'twentyeleven' ) This is come code that came out of the title tag for a post; the full code within the title ...
0
votes
2answers
861 views

Trouble inserting string containing quotations marks with wpdb in save_post hook

I'm having trouble with inserting a string which is containing quotation marks in wordpress via wpdb. I've written a hook for save_post and trying to write the post_title in a table via wpdp->update. ...
0
votes
1answer
2k views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo ""XSS" print_r( ...
0
votes
1answer
179 views

esc_url not working within add_settings_field callback

I'm trying to display a saved option of a url inside a text input on my themes' options page, but it's just simply not displaying. I've checked the database and my url is saved using the specified ...
1
vote
1answer
2k views

How to get my post title to work with an apostrophe ('s)?

When saving a post with the title Jule's Gormet, it gets formatted as Jule's Gormet. If I save it again, it becomes Jule's Gormet. Following this pattern, it keeps escaping ...
11
votes
2answers
3k views

Should I escape wordpress functions like the_title, the_excerpt, the_content

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
1
vote
1answer
241 views

When I re-save a post with [code] sections, the entities are double-escaped (> becomes > etc)

I've a hard time googling for this issue. On my blog, whenever I update an existing page, code sections are doubly escaped. I.e., on a recent page I have find /V "QWERTYUIOPPO" < calc.exe:yourads....
-1
votes
1answer
48 views

problem with quotes on new post

i have a little form to post: $post_content = '"Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit..."'; $post = array( 'post_author' => 1, ...
0
votes
1answer
222 views

how can i send this to wp_head - escape problem

how can escape this char ----> ; i ask becuse i want to use this to send some javascript to the head using wp_head this is want i want to attach to wp_head: add_action('wp_head', '...
9
votes
2answers
3k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., <...
1
vote
2answers
2k views

why is esc_html() returning nothing given a string containing a high-bit character?

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
1
vote
1answer
2k views

what's different between esc_attr, htmlspecialchars and htmlentities

Can I simply use htmlspecialchars instead of esc_attr?
1
vote
1answer
523 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...