The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
18 views

Render the metabox input values as HTML

I'm new to PHP and WordPress. I've created a site on WordPress, where the user can add an HTML code snippet (the inputs are taken using a metabox and displayed). The problem is WordPress doesn't ...
1
vote
1answer
675 views

Allow all attributes in $allowedposttags tags

I would like to use $allowedposttags to allow extra HTML tags during entry submission. Can I allow all attributes for a specific tag using $allowedposttags? For example, the code below will allow ...
0
votes
2answers
538 views

Allow iframe in custom meta box

I've created a custom meta box called 'Location Map' and want to provide a functionality to the client to simply copy paste the location's google map's iframe embed code so that it directly appears on ...
1
vote
0answers
14 views

How to escape attachment image caption text?

I'm outputting an attachment image's caption but feel I should escape the output: <figcaption> <?php echo get_post( get_post_thumbnail_id() )->post_excerpt; ?> </figcaption> ...
0
votes
0answers
17 views

How to escape content of enclosing shortcode the right way?

What's the right way of escaping the content of an enclosing shortcode without messing enclosed (self-closing) shortcodes up? [my-enclosing-shortcode] [some-self-closing-shortcode foo="bar"] [...
0
votes
1answer
29 views

How to make MySQL search queries with quotes

Hi everybody I run a wordpress based website and I'd like to store the search queries called by users to use them as analytics data to know what's most searched etc... So I have a custom table where ...
1
vote
2answers
43 views

How Flexible are the WordPress Coding Standards for PHPCS?

In my WordPress workflow I use Gulp and have a task that runs my PHP files through PHPCS using the WordPress coding standards tests (https://github.com/WordPress-Coding-Standards/WordPress-Coding-...
4
votes
2answers
111 views

esc before saving or before displaying does it matter?

In a lot of how to create a custom meta box tutorials, when saving data, i.e., update_post_meta the data is escaped: update_post_meta( $post_id, 'city', esc_attr( ucwords( $_POST['city'] ) ) ); ...
2
votes
1answer
856 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
6
votes
3answers
10k views

How to prevent escaping when saving HTML code in an option value?

I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again. ...
0
votes
0answers
20 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
1answer
46 views

Unexpected esc_html and esc_attr behaviour

On my site's search results page I am outputting the search term as follows: <?php echo esc_html($_GET['s']); ?> For the search term "SEARCH-TERM" (including the quotes) I would expect this ...
0
votes
1answer
63 views

Proper way to use esc_html__ and esc_attr__ etc for escaping value for translation

From the articles on Codex, esc_attr_e is proper way to escaping value for translation. But from other articles, I read about sanitizing issue and security issue for some escaping code. For my code, I ...
4
votes
1answer
55 views

Do I need to escape data passed to wp_localize_script()?

Title pretty much says it all. I took a look at the source, and I didn't see any escaping being done. But, I can't say for sure. wp_localize_script( 'script-hook', 'object_name', array( 'param_1' ...
4
votes
2answers
73 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
0
votes
1answer
25 views

Echoing a URL to a link

I've found the esc_url() function and I'm trying to understand what to do with URLs in Wordpress, before resorting to my normal PHP tactics. I see that the third parameter is used to set the filter ...
2
votes
1answer
66 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ?&...
0
votes
2answers
236 views

Allow HTML in Settings API input field

I want to allow HTML into a plugin input field via a user, I am using the Settings API, but it strips everything HTML out. - Code below -any pointers? function plugin_settings(){ register_Setting( ...
0
votes
1answer
265 views

Add HTML to Term Description

I'm trying to add ( using wp_editor ) an HTML Term Description without a pluign. Whenever I try and spit out the data I get escaped HTML back: &lt;strong&gt;test&lt;/strong&gt; ...
0
votes
3answers
63 views

Escape html structure in php

I have code like this: <?php echo '<div class="class-name">' . __( 'Text','text-domain' ) . '</div>'; ?> in a plugin of mine. Do i have to escape this? (esc_html or similiar)?
2
votes
1answer
98 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
1
vote
0answers
133 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same thing? I tried the following: $fetch_row='<p>And again for single posts</p>' echo mysql_real_escape_string( $...
6
votes
1answer
289 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
0
votes
1answer
192 views

Wrapping add_query_arg with esc_url not working

I know about the XSS issue related to add_query_arg()function. That is why I am wrapping it with esc_url(). Problem is...this is not working with wp_remote_get(). If I go: $url = add_query_arg( ...
0
votes
1answer
133 views

Updating a post without escaping ampersands?

I've found that wp_update_post() escapes all ampersands provided in the post's post_content. I'm trying to update a post without converting ampersands to &amp;. (I need to add plaintext URLs (...
0
votes
1answer
350 views

Using esc_attr_e

From what I understand esc_attr_e is ideally used for escaping values in attributes - Is it right that the usage of esc_attr_e can also be worked in with non attribute values, such as the h3 and label ...
0
votes
0answers
39 views

site_url() returns with additional backslashes

I am using site_url() function and it returns the address as http:\/\/vip.local\/cc where I can see that WP automatically adds unnecessary backslashes. Is this for some escaping purpose? I tried using ...
3
votes
1answer
671 views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
0
votes
1answer
176 views

ACF Unexpected T_CONSTANT_ENCAPSED_STRING [closed]

I'm running the Advanced Custom Fields Pro plugin. When I implement the following code for the repeater field, I get this PHP error: Parse error: syntax error, unexpected ...
2
votes
2answers
4k views

How do I stop HTML entities in a custom meta box from being un-htmlentitied?

I have a custom meta box that is supposed to accept HTML, but the text I'm trying to input contains both double and single quotes (and ampersands), and it's messing up the saved data - each time I ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
5
votes
1answer
4k views

How to use wildcards in $wpdb queries using $wpdb->get_results & $wpdb->prepare?

I am attempting to make a custom search for BuddyPress groups. Here is my method: public function search_groups($string){ global $wpdb; $results = $wpdb->get_results($wpdb->prepare( ...
4
votes
1answer
4k views

Difference between esc_url() and esc_url_raw()

http://core.trac.wordpress.org/browser/trunk/wp-includes/formatting.php#L2239 I'm confused about when should either of them be used. Assuming I have this URL: http://site.com/?getsomejavascript=1, ...
1
vote
0answers
103 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
0
votes
4answers
160 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
250 views

How to pass an array as attribute of shortcode to work properly shortcode parser?

echo '[test attr="'.json_encode(array('test'=>'my[][dfd]dfds[][][')).'"]'; //How to safe pass the array as attribute in shortcodes ?
2
votes
0answers
491 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
2
votes
1answer
2k views

How to correctly escape query variables to be used in WP_Query

I've got custom query variables that are added via query_vars. For example, 'industry'. In pre_get_posts action I construct and add taxonomy query if there is a value for the 'industry' parameter, ...
1
vote
0answers
507 views

How to save double quotes in post meta, when the post meta data is an array? [closed]

Ok so I've been scratching my head on this one for a while. I'm making a plugin that adds a custom meta box to a custom post type. I'm using the update_post_meta function to save the data from the ...
0
votes
0answers
21 views

Why does wp add slashes to $_POST? [duplicate]

Why does wp add slashes to $_POST values? All my quotes in my $_POST are escaped.. is there a reason for that??
1
vote
1answer
230 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
0
votes
1answer
52 views

wordpress post not showing my “<somehting>” text>?

I am trying to make a post where there is a text line : some libraries to run which we will import by using "#include <filename.h>" command. instead of outputting the text as it is. It ...
0
votes
0answers
40 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
1
vote
3answers
3k views

Disable escaping html

I'm using SyntaxHighlighter Evolved to highlight code examples. E.g. [csharp] string s = "text"; List<int> numbers = new List<int>(); [/csharp] When I first save it, it's ok, but when ...
1
vote
1answer
114 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
5
votes
1answer
2k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
1
vote
1answer
1k views

How to sanitize user input?

What is the correct way sanitizing form data before submitting to the database? I have the following text input: <form method="post" action="options.php"> <?php wp_nonce_field('update-...
0
votes
0answers
79 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the <pre><...
1
vote
1answer
845 views

Post Content, Special Characters and Filters

I added a hook to the_content. add_filter('the_content', 'edit_the_content'); function edit_the_content($content){ return $content; } Pretty simple right? However, when it output $content from ...
2
votes
3answers
6k views

When do I need to use esc_attr when using WordPress internal functions

When I am putting a WordPress value inside the attribute tag, for example, the following method does not need esc_attr e.g. // JS code alert('<?php echo get_bloginfo('name');?>'); the ...